Search Engine Redirects

I get redirected when I try to browse links from google and yahoo searches. I was able to bypass it at first by opening in new tabs but now that doesnt work anymore. I can still copy link location and paste it to a new window. I'm using Mozilla Firefox with Adblockplus and scriptblocker.

Here are some logs to work off of:

OTL Extras logfile created on: 8/10/2010 11:59:58 PM - Run 1
OTL by OldTimer - Version 3.2.9.0 Folder = C:\Users\Chan\Desktop
Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 66.00% Memory free
6.00 Gb Paging File | 5.00 Gb Available in Paging File | 81.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 465.66 Gb Total Space | 97.05 Gb Free Space | 20.84% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: CHAN-PC
Current User Name: Chan
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox 4.0 Beta 2\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Mozilla Firefox 4.0 Beta 1\firefox.exe" -requestPending -osint -url "%1" File not found
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00BA866C-F2A2-4BB9-A308-3DFA695B6F7C}" = Java DB 10.5.3.0
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0C826C5B-B131-423A-A229-C71B3CACCD6A}" = CDDRV_Installer
"{11083C7A-D0D6-4DA4-8C3A-74B8389EC07B}" = ATI Catalyst Registration
"{1D2C96C3-A3F3-49E7-B839-95279DED837F}" = Opera 10.60
"{1F0A73B4-6187-3CE7-B07A-807BC8F28B4F}" = ccc-utility
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{21A8BF7D-C50D-E655-1E25-99C7924A69F6}" = ATI Catalyst Install Manager
"{2212E17D-2931-5F26-9213-00EEC82C7EF0}" = ccc-core-static
"{2624B969-7135-4EB1-B0F6-2D8C397B45F7}_is1" = Media Player Classic - Home Cinema v. 1.3.1249.0
"{26A24AE4-039D-4CA4-87B4-2F83216021FF}" = Java(TM) 6 Update 21
"{2FFE93F0-BB72-4E52-8761-354D1AAA9387}" = Sony Ericsson PC Suite 6.011.00
"{3101CB58-3482-4D21-AF1A-7057FC935355}" = KhalInstallWrapper
"{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver
"{32A3A4F4-B792-11D6-A78A-00B0D0160210}" = Java(TM) SE Development Kit 6 Update 21
"{34BDF3BF-AA61-42E7-8818-C16A304910FC}" = Emma Core
"{3AC8457C-0385-4BEA-A959-E095F05D6D67}" = Battlefield: Bad Company™ 2
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3DB2107E-82FE-3167-6E71-B9D44EA4FD26}" = AMD Drag and Drop Transcoding
"{3FAD68D9-1FA1-4871-9ADF-9151D969E943}" = Activision(R)
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{503231D1-3A81-69DC-A95D-5273AB7A1CCC}" = Catalyst Control Center Graphics Previews Vista
"{59C80C5E-8C92-40FF-B910-2BB5C7281F61}" = Europa Universalis III
"{64893225-ADBA-469E-B114-F3B2C1FBBA77}" = RTKXI
"{65A92AAA-3D05-4C94-9F70-731C05E60C16}" = NVIDIA System Update
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6C1804BC-094F-431A-BEA5-37A837958029}" = Rome - Total War - Alexander
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{75D84EF7-0D8C-4e70-B3FA-7B42A5D4E0EB}" = Mass Effect 2
"{789289CA-F73A-4A16-A331-54D498CE069F}" = Ventrilo Client
"{7C7F30F4-94E7-4AA8-8941-90C4A80C68BF}" = NVIDIA Performance
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{87323561-58BA-4D5B-BADA-A791B69D1705}" = Catalyst Control Center - Branding
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver For Windows Vista and Later
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8ACC73AA-6511-7C55-B1A9-8E5D1DEAFAA3}" = The Lord of the Rings FREE Trial
"{8EA5CBF8-DFF4-5C69-9434-F87F8C21293C}" = Catalyst Control Center Graphics Previews Common
"{92606477-9366-4D3B-8AE3-6BE4B29727AB}" = League of Legends
"{95120000-003F-0409-0000-0000000FF1CE}" = Microsoft Office Excel Viewer
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9922FE96-6803-498D-A6AD-4EB5A3B956A5}" = Belkin Wireless G Plus MIMO USB Network Adapter
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A498D9EB-927B-459B-85D6-DD6EF8C2C564}" = erLT
"{A642BB6B-CA1D-4142-8DD4-318C3F3DC834}" = Rome - Total War(TM)
"{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3.3
"{AEC81925-9C76-4707-84A9-40696C613ED3}" = Dragon Age: Origins
"{B194272D-1F92-46DF-99EB-8D5CE91CB4EC}" = Adobe AIR
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B883FC57-818A-2C84-34CF-917B3C56C85B}" = CCC Help English
"{C3234E43-10BF-470E-BD2B-2E36EA29D11C}" = League of Legends
"{C5C1C0F0-D62F-4DBF-81D4-D7EF397C228B}" = NVIDIA PhysX
"{CADDE354-C78C-46CB-A006-E2B178EFC271}" = Rise Of Legends
"{DEA314C4-0929-4250-BC92-98E4C105F28D}" = NVIDIA PhysX
"{E10DB5DA-E576-40EA-A7FC-1CB2A7B283A6}" = NVIDIA PhysX
"{E1E502E2-C006-49DB-9C0C-F2196E51826F}_is1" = Rootkit Unhooker LE 3.8 SR 2
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E6B87DC4-2B3D-4483-ADFF-E483BF718991}" = OpenOffice.org 3.1
"{E9CFBE78-ED91-4FCF-9E6F-210E477E527D}" = NVIDIA System Monitor
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F29B21BD-CAA6-445F-8EF7-A7E2B9D8B14E}" = Logitech SetPoint
"{FD69C8CB-6964-432C-98AB-A5A09ED50EEA}" = Barbarian Invasion
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"8461-7759-5462-8226" = Vuze
"Abexo Free Registry Cleaner" = Abexo Free Registry Cleaner
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"AIM_7" = AIM 7
"avast!" = avast! Antivirus
"AVG9Uninstall" = AVG Free 9.0
"CANONIJINBOXADDON200" = Canon Inkjet Printer Driver Add-On Module V2.00
"CCleaner" = CCleaner
"CPUID CPU-Z_is1" = CPUID CPU-Z 1.54
"CPUID HWMonitor_is1" = CPUID HWMonitor 1.15
"DAEMON Tools Toolbar" = DAEMON Tools Toolbar
"Defraggler" = Defraggler
"GamersFirst LIVE!" = GamersFirst LIVE!
"GamersFirst War Rock" = War Rock
"hon" = Heroes of Newerth
"InstallShield_{3FAD68D9-1FA1-4871-9ADF-9151D969E943}" = Singularity(TM)
"InstallShield_{65A92AAA-3D05-4C94-9F70-731C05E60C16}" = NVIDIA System Update
"InstallShield_{7C7F30F4-94E7-4AA8-8941-90C4A80C68BF}" = NVIDIA Performance
"InstallShield_{A642BB6B-CA1D-4142-8DD4-318C3F3DC834}" = Rome - Total War(TM)
"InstallShield_{CADDE354-C78C-46CB-A006-E2B178EFC271}" = Rise Of Legends
"InstallShield_{E9CFBE78-ED91-4FCF-9E6F-210E477E527D}" = NVIDIA System Monitor
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Media Player Classic" = Media Player Classic
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Mozilla Firefox (4.0b2)" = Mozilla Firefox (4.0b2)
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"OCCT_is1" = OCCT Perestroika 3.1.0
"PokerStars" = PokerStars
"Precision" = EVGA Precision 1.9.1
"SEMC OMSI Module" = SEMC OMSI Module
"SoftwareUpdUtility" = Download Updater (AOL LLC)
"SopCast" = SopCast 3.2.9
"StarCraft Brood War by Monikon 1.16.1" = StarCraft Brood War by Monikon 1.16.1
"StarCraft II" = StarCraft II
"Steam App 10" = Counter-Strike
"Steam App 10180" = Call of Duty: Modern Warfare 2
"Steam App 10190" = Call of Duty: Modern Warfare 2 - Multiplayer
"Steam App 41300" = Altitude
"VLC media player" = VLC media player 1.1.0
"Warcraft III" = Warcraft III
"Winamp" = Winamp
"WinRAR archiver" = WinRAR archiver

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"InstallShield_{64893225-ADBA-469E-B114-F3B2C1FBBA77}" = RTKXI

========== Last 10 Event Log Errors ==========

[ Antivirus Events ]
Error - 7/29/2010 6:22:03 PM | Computer Name = Chan-PC | Source = avast! | ID = 33554522
Description = Error in aswChestC: chestOpenList Error 1753.

Error - 7/29/2010 6:22:03 PM | Computer Name = Chan-PC | Source = avast! | ID = 33554522
Description = aswChestInterface - Program error description: CChestListView::LoadFiles()
chestOpenList() failed: 2147422219.

Error - 7/29/2010 6:42:05 PM | Computer Name = Chan-PC | Source = avast! | ID = 33554522
Description = aswChestInterface - Program error description: CChestListView::OnCreate()
!m_strErrorWnd.IsEmpty().


========== Last 10 Event Log Errors ==========

Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!

< End of report >

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:50:12 PM, on 8/10/2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Windows\System32\rundll32.exe
C:\Windows\explorer.exe
C:\Program Files\Mozilla Firefox 4.0 Beta 2\firefox.exe
C:\Program Files\AIM\aim.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Chan\Desktop\Diagnostics\.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: (no name) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - (no file)
O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: (no name) - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - (no file)
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

--
End of file - 2383 bytes

Hello, and welcome to GeekPolice.

Please note the following information about the malware forum:

• Only Tech Officers, Global Moderators, Administrators, and Malware Advisors are allowed to give advice on removing malware from your computer.
  
• From this point on, please do not make any more changes to your computer; such as install/uninstall programs, use special fix tools, delete files, edit the registry, etc. - unless advised by the staff I noted above.
  
• Please do not ask for help elsewhere (in this site or other sites). Doing so can result in system changes, which may not show up in the logs you post.
  
• If you have already asked for help somewhere, please post the link to the topic you were helped.
  
• We try our best to reply quickly, but for any reason we do not reply in two days, do one of two things:
  
  Reply to this topic with the word BUMP, or
  see this topic.
  
  
• Lastly, keep in mind that we are volunteers, so you do not have to pay for malware removal. Persist in this topic until its close, and your computer is declared clean.

---

Please download 7-Zip and install it. If you already have it, no need to reinstall.

Then, download RootkitUnhooker and save the setup to your Desktop.

• Right-click on the RootkitUnhooker setup and mouse-over 7-Zip then click Extract to "RKU***"
  
• Once that is done, enter the folder, and double-click on the setup file. Navigate through setup and finish.
  
• Once that is done, you will see another folder that was created inside the RKU folder. Enter that folder, and double-click on the randomly named file. (It will be alpha-numeric and have an EXE extension on it.)
  
• It will initialize itself and load the scanner. It will also install its driver. Please wait for the interface to begin.
  
• Once inside the interface, do not fix anything. Click on the Report tab.
  
• Next, click on the Scan button and a popup will show. Make sure all are checked, then click on OK. It will begin scanning. When it gets to the Files tab, it will ask you what drives to scan. Just select C:\ and hit OK.
  
• It will finish in about 5 minutes or a little longer depending on how badly infected the system is, or if your security software is enabled.
  
• When finished, it will show the report in the Report tab. Please copy all of it, and post it in your next reply. Depending on how large the log is, you may have to use two or three posts to get all the information in.

I decided to cancel the scan on files because the progression bar seemed to freeze at 20% for over an hour.

RkU Version: 3.8.388.590, Type LE (SR2)
==============================================
OS Name: Windows 7
Version 6.1.7600
Number of processors #4
==============================================
>SSDT State
==============================================
==============================================
>Shadow
==============================================
==============================================
>Processes
==============================================
0x86E92890 [288] C:\Windows\System32\smss.exe (Microsoft Corporation, Windows Session Manager)
0x86CB9A00 [420] C:\Windows\System32\csrss.exe (Microsoft Corporation, Client Server Runtime Process)
0x876CAD40 [492] C:\Windows\System32\wininit.exe (Microsoft Corporation, Windows Start-Up Application)
0x86C7EA58 [504] C:\Windows\System32\csrss.exe (Microsoft Corporation, Client Server Runtime Process)
0x876F1A40 [544] C:\Windows\System32\services.exe (Microsoft Corporation, Services and Controller app)
0x876F6388 [560] C:\Windows\System32\lsass.exe (Microsoft Corporation, Local Security Authority Process)
0x876F6728 [568] C:\Windows\System32\lsm.exe (Microsoft Corporation, Local Session Manager Service)
0x876FEC88 [600] C:\Windows\System32\winlogon.exe (Microsoft Corporation, Windows Logon Application)
0x87A065B8 [700] C:\Program Files\Emsisoft Anti-Malware\a2service.exe (Emsi Software GmbH, Emsisoft Anti-Malware Service)
0x87787B38 [728] C:\Windows\System32\svchost.exe (Microsoft Corporation, Host Process for Windows Services)
0x86CFD728 [820] C:\Windows\System32\svchost.exe (Microsoft Corporation, Host Process for Windows Services)
0x877F0D40 [912] C:\Windows\System32\svchost.exe (Microsoft Corporation, Host Process for Windows Services)
0x87808938 [948] C:\Windows\System32\svchost.exe (Microsoft Corporation, Host Process for Windows Services)
0x8782B958 [1000] C:\Windows\System32\svchost.exe (Microsoft Corporation, Host Process for Windows Services)
0x87872030 [1168] C:\Windows\System32\svchost.exe (Microsoft Corporation, Host Process for Windows Services)
0x878C5528 [1392] C:\Windows\System32\svchost.exe (Microsoft Corporation, Host Process for Windows Services)
0x878F9528 [1488] C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (ALWIL Software, avast! Antivirus updating service)
0x87624260 [1512] C:\Program Files\Alwil Software\Avast4\ashServ.exe (ALWIL Software, avast! antivirus service)
0x87239890 [1724] C:\Windows\System32\spoolsv.exe (Microsoft Corporation, Spooler SubSystem App)
0x8726DD00 [1756] C:\Windows\System32\svchost.exe (Microsoft Corporation, Host Process for Windows Services)
0x8727FD40 [1944] C:\Windows\System32\svchost.exe (Microsoft Corporation, Host Process for Windows Services)
0x85C3B870 [2124] C:\Program Files\Windows NT\Accessories\wordpad.exe (Microsoft Corporation, Windows Wordpad Application)
0x87AE7D40 [2292] C:\Windows\System32\svchost.exe (Microsoft Corporation, Host Process for Windows Services)
0x85F87938 [2328] C:\Program Files\AIM\aim.exe (AOL Inc., AOL Instant Messenger)
0x86150030 [2392] C:\Windows\explorer.exe (Microsoft Corporation, Windows Explorer)
0x87B3F278 [2592] C:\Windows\System32\dwm.exe (Microsoft Corporation, Desktop Window Manager)
0x8791BAD0 [2644] C:\Program Files\Emsisoft Anti-Malware\a2wizard.exe (Emsi Software GmbH, Security Wizard)
0x86DFC3A8 [2868] C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software, avast! service GUI component)
0xD5E5F558 [2928] C:\Windows\System32\MustBeRandomlyNamed\w3du1Uogd7.exe (UG North, RKULE, SR2 Normandy)
0x87B29030 [3128] C:\Program Files\Windows Media Player\wmpnetwk.exe (Microsoft Corporation, Windows Media Player Network Sharing Service)
0x85B79D40 [3256] C:\Windows\System32\svchost.exe (Microsoft Corporation, Host Process for Windows Services)
0x86DBE950 [3308] C:\Program Files\Mozilla Firefox 4.0 Beta 2\plugin-container.exe (Mozilla Corporation, Plugin Container for Firefox)
0x85B93648 [3368] C:\Windows\System32\SearchIndexer.exe (Microsoft Corporation, Microsoft Windows Search Indexer)
0x85EC6D40 [3724] C:\Windows\System32\svchost.exe (Microsoft Corporation, Host Process for Windows Services)
0x8716C030 [3876] C:\Program Files\Mozilla Firefox 4.0 Beta 2\firefox.exe (Mozilla Corporation, Firefox)
0xC9D0ABE8 [3908] C:\Program Files\Mozilla Firefox 4.0 Beta 2\plugin-container.exe (Mozilla Corporation, Plugin Container for Firefox)
0x86E73110 [3960] C:\Windows\System32\rundll32.exe (Microsoft Corporation, Windows host process (Rundll32))
0x85907810 [4] System
0x8604E030 [768] C:\Windows\System32\audiodg.exe (Microsoft Corporation, Windows Audio Device Graph Isolation )
==============================================
>Drivers
==============================================
0x9220C000 C:\Windows\system32\DRIVERS\atikmdag.sys 5910528 bytes (ATI Technologies Inc., ATI Radeon Kernel Mode Driver)
0x82E39000 C:\Windows\system32\ntkrnlpa.exe 4259840 bytes (Microsoft Corporation, NT Kernel & System)
0x82E39000 PnpManager 4259840 bytes
0x82E39000 RAW 4259840 bytes
0x82E39000 WMIxWDM 4259840 bytes
0x93C2D000 C:\Windows\system32\drivers\RTKVHDA.sys 3035136 bytes (Realtek Semiconductor Corp., Realtek(r) High Definition Audio Function Driver)
0x99160000 Win32k 2400256 bytes
0x99160000 C:\Windows\System32\win32k.sys 2400256 bytes (Microsoft Corporation, Multi-User Win32 Driver)
0x8C031000 C:\Windows\System32\drivers\tcpip.sys 1347584 bytes (Microsoft Corporation, TCP/IP Driver)
0x8BC3A000 C:\Windows\System32\Drivers\Ntfs.sys 1241088 bytes (Microsoft Corporation, NT File System Driver)
0x92813000 C:\Windows\System32\drivers\dxgkrnl.sys 749568 bytes (Microsoft Corporation, DirectX Graphics Kernel)
0x8BEA5000 C:\Windows\system32\drivers\ndis.sys 749568 bytes (Microsoft Corporation, NDIS 6.20 driver)
0x834FF000 C:\Windows\system32\CI.dll 700416 bytes (Microsoft Corporation, Code Integrity Module)
0x9E4D6000 C:\Windows\system32\drivers\peauth.sys 618496 bytes (Microsoft Corporation, Protected Environment Authentication and Authorization Export Driver)
0x92F78000 C:\Windows\system32\drivers\HTTP.sys 544768 bytes (Microsoft Corporation, HTTP Protocol Stack)
0x8342C000 C:\Windows\system32\mcupdate_GenuineIntel.dll 491520 bytes (Microsoft Corporation, Intel Microcode Update Library)
0x83638000 C:\Windows\system32\drivers\Wdf01000.sys 462848 bytes (Microsoft Corporation, Kernel Mode Driver Framework Runtime)
0x91822000 C:\Windows\system32\drivers\csc.sys 409600 bytes (Microsoft Corporation, Windows Client Side Caching Driver)
0x8BE31000 C:\Windows\System32\Drivers\cng.sys 380928 bytes (Microsoft Corporation, Kernel Cryptography, Next Generation)
0x9127F000 C:\Windows\system32\drivers\afd.sys 368640 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock)
0x9CAC9000 C:\Windows\System32\DRIVERS\srv.sys 331776 bytes (Microsoft Corporation, Server driver)
0x9CA7A000 C:\Windows\System32\DRIVERS\srv2.sys 323584 bytes (Microsoft Corporation, Smb 2.0 Server driver)
0x9293D000 C:\Windows\system32\DRIVERS\USBPORT.SYS 307200 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver)
0x83766000 C:\Windows\System32\drivers\volmgrx.sys 307200 bytes (Microsoft Corporation, Volume Manager Extension Driver)
0x836B7000 C:\Windows\system32\DRIVERS\ACPI.sys 294912 bytes (Microsoft Corporation, ACPI Driver for NT)
0x92F0F000 C:\Windows\system32\DRIVERS\nwifi.sys 286720 bytes (Microsoft Corporation, NativeWiFi Miniport Driver)
0x92E0F000 C:\Windows\system32\DRIVERS\usbhub.sys 278528 bytes (Microsoft Corporation, Default Hub Driver for USB)
0x9E481000 C:\Windows\system32\DRIVERS\atksgt.sys 274432 bytes
0x834BD000 C:\Windows\system32\CLFS.SYS 270336 bytes (Microsoft Corporation, Common Log File System Driver)
0x91376000 C:\Windows\system32\DRIVERS\rdbss.sys 266240 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver)
0x8C1B4000 C:\Windows\system32\DRIVERS\volsnap.sys 258048 bytes (Microsoft Corporation, Volume Shadow Copy Driver)
0x8BF5C000 C:\Windows\system32\drivers\NETIO.SYS 253952 bytes (Microsoft Corporation, Network I/O Subsystem)
0x9E424000 C:\Windows\system32\DRIVERS\mrxsmb10.sys 241664 bytes (Microsoft Corporation, Longhorn SMB Downlevel SubRdr)
0x91209000 C:\Windows\System32\Drivers\avgtdix.sys 237568 bytes (AVG Technologies CZ, s.r.o., AVG Network connection watcher)
0x928CA000 C:\Windows\System32\drivers\dxgmms1.sys 233472 bytes (Microsoft Corporation, DirectX Graphics MMS)
0x9193A000 C:\Windows\system32\DRIVERS\atikmpag.sys 229376 bytes (Advanced Micro Devices, Inc., AMD multi-vendor Miniport Driver)
0x82E02000 ACPI_HAL 225280 bytes
0x82E02000 C:\Windows\system32\halmacpi.dll 225280 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL)
0x918B2000 C:\Windows\System32\Drivers\avgldx86.sys 212992 bytes (AVG Technologies CZ, s.r.o., AVG AVI Loader Driver)
0x835AA000 C:\Windows\system32\drivers\fltmgr.sys 212992 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager)
0x919A3000 C:\Windows\system32\DRIVERS\ks.sys 212992 bytes (Microsoft Corporation, Kernel CSA Library)
0x8BDA7000 C:\Windows\System32\DRIVERS\fvevol.sys 204800 bytes (Microsoft Corporation, BitLocker Drive Encryption Driver)
0x91243000 C:\Windows\System32\DRIVERS\netbt.sys 204800 bytes (Microsoft Corporation, MBT Transport driver)
0x8C17A000 C:\Windows\System32\drivers\fwpkclnt.sys 200704 bytes (Microsoft Corporation, FWP/IPsec Kernel-Mode API)
0x92E8C000 C:\Windows\system32\drivers\portcls.sys 192512 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices))
0x8C000000 C:\Windows\System32\drivers\rdyboost.sys 184320 bytes (Microsoft Corporation, ReadyBoost Driver)
0x8BD69000 C:\Windows\System32\Drivers\msrpc.sys 176128 bytes (Microsoft Corporation, Kernel Remote Procedure Call Provider)
0x9CBB0000 C:\Windows\System32\Drivers\fastfat.SYS 172032 bytes (Microsoft Corporation, Fast FAT File System Driver)
0x8371B000 C:\Windows\system32\DRIVERS\pci.sys 172032 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator)
0x8BE00000 C:\Windows\system32\DRIVERS\CLASSPNP.SYS 151552 bytes (Microsoft Corporation, SCSI Class System Dll)
0x8BF9A000 C:\Windows\System32\Drivers\ksecpkg.sys 151552 bytes (Microsoft Corporation, Kernel Security Support Provider Interface Packages)
0x83600000 C:\Windows\system32\DRIVERS\ataport.SYS 143360 bytes (Microsoft Corporation, ATAPI Driver Extension)
0x913D7000 C:\Windows\system32\DRIVERS\mrxsmb.sys 143360 bytes (Microsoft Corporation, Windows NT SMB Minirdr)
0x927AF000 C:\Windows\system32\DRIVERS\ndiswan.sys 139264 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption))
0x9134E000 C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS 139264 bytes
0x918E6000 C:\Windows\System32\Drivers\aswSP.SYS 135168 bytes (ALWIL Software, avast! self protection module)
0x9E577000 C:\Windows\System32\DRIVERS\srvnet.sys 135168 bytes (Microsoft Corporation, Server Network driver)
0x91907000 C:\Windows\system32\DRIVERS\tunnel.sys 135168 bytes (Microsoft Corporation, Microsoft Tunnel Interface Driver)
0x835DE000 C:\Windows\System32\drivers\VIDEOPRT.SYS 135168 bytes (Microsoft Corporation, Video Port Driver)
0x92903000 C:\Windows\system32\DRIVERS\HDAudBus.sys 126976 bytes (Microsoft Corporation, High Definition Audio Bus Driver)
0x912E4000 C:\Windows\system32\DRIVERS\pacer.sys 126976 bytes (Microsoft Corporation, QoS Packet Scheduler)
0x92E6E000 C:\Windows\system32\drivers\AtiHdmi.sys 122880 bytes (ATI Technologies, Inc., ATI High Definition Audio Function Driver)
0x99000000 C:\Windows\System32\cdd.dll 122880 bytes (Microsoft Corporation, Canonical Display Driver)
0x93C00000 C:\Windows\system32\drivers\luafv.sys 110592 bytes (Microsoft Corporation, LUA File Virtualization Filter Driver)
0x9E45F000 C:\Windows\system32\DRIVERS\mrxsmb20.sys 110592 bytes (Microsoft Corporation, Longhorn SMB 2.0 Redirector)
0x91311000 C:\Windows\system32\DRIVERS\serial.sys 106496 bytes (Microsoft Corporation, Serial Device Driver)
0x92ED4000 C:\Windows\system32\drivers\WudfPf.sys 106496 bytes (Microsoft Corporation, Windows Driver Foundation - User-mode Driver Framework Platform Driver)
0x91800000 C:\Windows\system32\DRIVERS\bowser.sys 102400 bytes (Microsoft Corporation, NT Lan Manager Datagram Receiver Driver)
0x92EBB000 C:\Windows\system32\drivers\drmk.sys 102400 bytes (Microsoft Corporation, Microsoft Trusted Audio Drivers)
0x91886000 C:\Windows\System32\Drivers\dfsc.sys 98304 bytes (Microsoft Corporation, DFS Namespace Client Driver)
0x929AC000 C:\Windows\system32\DRIVERS\parport.sys 98304 bytes (Microsoft Corporation, Parallel Port Driver)
0x929E3000 C:\Windows\system32\DRIVERS\rasl2tp.sys 98304 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver)
0x927D1000 C:\Windows\system32\DRIVERS\raspppoe.sys 98304 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver)
0x93F44000 C:\Windows\system32\DRIVERS\aswMonFlt.sys 94208 bytes (ALWIL Software, avast! File System Minifilter for Windows 2003/Vista)
0x927E9000 C:\Windows\system32\DRIVERS\raspptp.sys 94208 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol)
0x91972000 C:\Windows\system32\DRIVERS\rassstp.sys 94208 bytes (Microsoft Corporation, RAS SSTP Miniport Call Manager)
0x8340E000 C:\Windows\system32\DRIVERS\tdx.sys 94208 bytes (Microsoft Corporation, TDI Translation Driver)
0x93FC0000 C:\Windows\system32\DRIVERS\usbccgp.sys 94208 bytes (Microsoft Corporation, USB Common Class Generic Parent Driver)
0x837C6000 C:\Windows\System32\drivers\mountmgr.sys 90112 bytes (Microsoft Corporation, Mount Point Manager)
0x9CB1E000 C:\Windows\system32\drivers\usbaudio.sys 81920 bytes (Microsoft Corporation, USB Audio Class Driver)
0x93F89000 C:\Windows\system32\DRIVERS\HIDCLASS.SYS 77824 bytes (Microsoft Corporation, Hid Class Library)
0x8BD94000 C:\Windows\System32\Drivers\ksecdd.sys 77824 bytes (Microsoft Corporation, Kernel Security Support Provider Interface)
0x92F65000 C:\Windows\system32\DRIVERS\rspndr.sys 77824 bytes (Microsoft Corporation, Link-Layer Topology Responder Driver for NDIS 6)
0x9132B000 C:\Windows\system32\DRIVERS\wanarp.sys 77824 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver)
0x929D1000 C:\Windows\system32\DRIVERS\AgileVpn.sys 73728 bytes (Microsoft Corporation, RAS Agile Vpn Miniport Call Manager)
0x91928000 C:\Windows\system32\DRIVERS\intelppm.sys 73728 bytes (Microsoft Corporation, Processor Device Driver)
0x919ED000 C:\Windows\System32\drivers\mpsdrv.sys 73728 bytes (Microsoft Corporation, Microsoft Protection Service Driver)
0x8BFD7000 C:\Windows\system32\DRIVERS\disk.sys 69632 bytes (Microsoft Corporation, PnP Disk Driver)
0x93F33000 C:\Windows\System32\Drivers\dump_dumpfve.sys 69632 bytes
0x837E5000 C:\Windows\system32\drivers\fileinfo.sys 69632 bytes (Microsoft Corporation, FileInfo Filter Driver)
0x92E5D000 C:\Windows\System32\Drivers\NDProxy.SYS 69632 bytes (Microsoft Corporation, NDIS Proxy)
0x83745000 C:\Windows\System32\drivers\partmgr.sys 69632 bytes (Microsoft Corporation, Partition Management Driver)
0x834A4000 C:\Windows\system32\PSHED.dll 69632 bytes (Microsoft Corporation, Platform Specific Hardware Error Driver)
0x92922000 C:\Windows\system32\DRIVERS\L1C62x86.sys 65536 bytes (Atheros Communications, Inc., Atheros L1c PCI-E Gigabit Ethernet Controller)
0x93C1B000 C:\Windows\system32\DRIVERS\lltdio.sys 65536 bytes (Microsoft Corporation, Link-Layer Topology Mapper I/O Driver)
0x8BFBF000 C:\Windows\System32\Drivers\mup.sys 65536 bytes (Microsoft Corporation, Multiple UNC Provider Driver)
0x92F55000 C:\Windows\system32\DRIVERS\ndisuio.sys 65536 bytes (Microsoft Corporation, NDIS User mode I/O driver)
0x9133E000 C:\Windows\system32\DRIVERS\termdd.sys 65536 bytes (Microsoft Corporation, Remote Desktop Server Driver)
0x83756000 C:\Windows\system32\DRIVERS\volmgr.sys 65536 bytes (Microsoft Corporation, Volume Manager Driver)
0x92988000 C:\Windows\system32\DRIVERS\usbehci.sys 61440 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver)
0x9189E000 C:\Windows\system32\DRIVERS\blbdrive.sys 57344 bytes (Microsoft Corporation, BLB Drive Driver)
0x91303000 C:\Windows\system32\DRIVERS\netbios.sys 57344 bytes (Microsoft Corporation, NetBIOS interface driver)
0x83400000 C:\Windows\System32\Drivers\Npfs.SYS 57344 bytes (Microsoft Corporation, NPFS Driver)
0x837B8000 C:\Windows\system32\DRIVERS\PCIIDEX.SYS 57344 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension)
0x8BE8E000 C:\Windows\System32\drivers\pcw.sys 57344 bytes (Microsoft Corporation, Performance Counters for Windows Driver)
0x919DF000 C:\Windows\system32\DRIVERS\umbus.sys 57344 bytes (Microsoft Corporation, User-Mode Bus Enumerator)
0x836A9000 C:\Windows\system32\drivers\WDFLDR.SYS 57344 bytes (Microsoft Corporation, Kernel Mode Driver Framework Loader)
0x929C4000 C:\Windows\system32\DRIVERS\CompositeBus.sys 53248 bytes (Microsoft Corporation, Multi-Transport Composite Bus Enumerator)
0x93F12000 C:\Windows\System32\Drivers\crashdmp.sys 53248 bytes (Microsoft Corporation, Crash Dump Driver)
0x91989000 C:\Windows\system32\DRIVERS\kbdclass.sys 53248 bytes (Microsoft Corporation, Keyboard Class Driver)
0x91996000 C:\Windows\system32\DRIVERS\mouclass.sys 53248 bytes (Microsoft Corporation, Mouse Class Driver)
0x9CA6D000 C:\Windows\System32\drivers\tcpipreg.sys 53248 bytes (Microsoft Corporation, TCP/IP Registry Compatibility Driver)
0x8BDEA000 C:\Windows\System32\drivers\watchdog.sys 53248 bytes (Microsoft Corporation, Watchdog Driver)
0x913CB000 C:\Windows\System32\drivers\discache.sys 49152 bytes (Microsoft Corporation, System Indexer/Cache Driver)
0x93FD7000 C:\Windows\system32\DRIVERS\kbdhid.sys 49152 bytes (Microsoft Corporation, HID Keyboard Filter Driver)
0x8BC2D000 C:\Windows\System32\drivers\vga.sys 49152 bytes (Microsoft Corporation, VGA/Super VGA Video Driver)
0x93F1F000 C:\Windows\System32\Drivers\dump_dumpata.sys 45056 bytes
0x92997000 C:\Windows\system32\DRIVERS\fdc.sys 45056 bytes (Microsoft Corporation, Floppy Disk Controller Driver)
0x93F7E000 C:\Windows\system32\DRIVERS\hidusb.sys 45056 bytes (Microsoft Corporation, USB Miniport Driver for Input Devices)
0x93FE3000 C:\Windows\system32\DRIVERS\monitor.sys 45056 bytes (Microsoft Corporation, Monitor Driver)
0x93FAD000 C:\Windows\system32\DRIVERS\mouhid.sys 45056 bytes (Microsoft Corporation, HID Mouse Filter Driver)
0x8BC10000 C:\Windows\System32\Drivers\Msfs.SYS 45056 bytes (Microsoft Corporation, Mailslot driver)
0x92800000 C:\Windows\system32\DRIVERS\ndistapi.sys 45056 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver)
0x8362C000 C:\Windows\system32\DRIVERS\TDI.SYS 45056 bytes (Microsoft Corporation, TDI Wrapper)
0x9CB32000 C:\Windows\system32\DRIVERS\usbprint.sys 45056 bytes (Microsoft Corporation, USB Printer driver)
0x92932000 C:\Windows\system32\DRIVERS\usbuhci.sys 45056 bytes (Microsoft Corporation, UHCI USB Miniport Driver)
0x83710000 C:\Windows\system32\DRIVERS\vdrvroot.sys 45056 bytes (Microsoft Corporation, Virtual Drive Root Enumerator)
0x91275000 C:\Windows\System32\Drivers\aswTdi.SYS 40960 bytes (ALWIL Software, avast! TDI Filter Driver)
0x93F6E000 C:\Windows\System32\drivers\Dxapi.sys 40960 bytes (Microsoft Corporation, DirectX API Driver)
0x92E53000 C:\Windows\system32\DRIVERS\flpydisk.sys 40960 bytes (Microsoft Corporation, Floppy Driver)
0x913C1000 C:\Windows\system32\DRIVERS\mssmbios.sys 40960 bytes (Microsoft Corporation, System Management BIOS Driver)
0x913B7000 C:\Windows\system32\drivers\nsiproxy.sys 40960 bytes (Microsoft Corporation, NSI Proxy)
0x92200000 C:\Windows\system32\DRIVERS\rdpbus.sys 40960 bytes (Microsoft Corporation, Microsoft RDP Bus Device driver)
0x9E56D000 C:\Windows\System32\Drivers\secdrv.SYS 40960 bytes (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K., Macrovision SECURITY Driver)
0x929A2000 C:\Windows\system32\DRIVERS\serenum.sys 40960 bytes (Microsoft Corporation, Serial Port Enumerator)
0x83623000 C:\Windows\system32\DRIVERS\amdxata.sys 36864 bytes (Advanced Micro Devices, Storage Filter Driver)
0x837DC000 C:\Windows\system32\DRIVERS\atapi.sys 36864 bytes (Microsoft Corporation, ATAPI IDE Miniport Driver)
0x9E4C8000 C:\Windows\system32\drivers\cpuz133_x32.sys 36864 bytes (Windows (R) Win 7 DDK provider, CPUID Driver)
0x93F2A000 C:\Windows\System32\Drivers\dump_atapi.sys 36864 bytes
0x8BE9C000 C:\Windows\System32\Drivers\Fs_Rec.sys 36864 bytes (Microsoft Corporation, File System Recognizer Driver)
0x9CBEB000 C:\Windows\System32\Drivers\Normandy.SYS 36864 bytes (RKU Driver)
0x993C0000 C:\Windows\System32\TSDDD.dll 36864 bytes (Microsoft Corporation, Framebuffer Display Driver)
0x8C1AB000 C:\Windows\system32\DRIVERS\vmstorfl.sys 36864 bytes (Microsoft Corporation, Virtual Storage Filter Driver)
0x836FF000 C:\Windows\system32\DRIVERS\WMILIB.SYS 36864 bytes (Microsoft Corporation, WMILIB WMI support library Dll)
0x93F5B000 C:\Windows\system32\DRIVERS\aswFsBlk.sys 32768 bytes (ALWIL Software, avast! File System Access Blocking Driver)
0x834B5000 C:\Windows\system32\BOOTVID.dll 32768 bytes (Microsoft Corporation, VGA Boot Driver)
0x8BFCF000 C:\Windows\System32\drivers\hwpolicy.sys 32768 bytes (Microsoft Corporation, Hardware Policy Driver)
0x86D07000 C:\Windows\system32\kdcom.dll 32768 bytes (Microsoft Corporation, Serial Kernel Debugger)
0x93FA5000 C:\Windows\system32\DRIVERS\LHidFilt.Sys 32768 bytes (Logitech, Inc., Logitech HID Filter Driver.)
0x93FB8000 C:\Windows\system32\DRIVERS\LMouFilt.Sys 32768 bytes (Logitech, Inc., Logitech Mouse Filter Driver.)
0x83708000 C:\Windows\system32\DRIVERS\msisadrv.sys 32768 bytes (Microsoft Corporation, ISA Driver)
0x919D7000 C:\Windows\system32\DRIVERS\nvoclock.sys 32768 bytes (NVIDIA Corp., NVIDIA System Utility Driver)
0x8BDF7000 C:\Windows\System32\DRIVERS\RDPCDD.sys 32768 bytes (Microsoft Corporation, RDP Miniport)
0x8BC00000 C:\Windows\system32\drivers\rdpencdd.sys 32768 bytes (Microsoft Corporation, RDP Encoder Miniport)
0x8BC08000 C:\Windows\system32\drivers\rdprefmp.sys 32768 bytes (Microsoft Corporation, RDP Reflector Driver Miniport)
0x8C1F3000 C:\Windows\System32\Drivers\spldr.sys 32768 bytes (Microsoft Corporation, loader for security processor)
0x8BC26000 C:\Windows\System32\Drivers\Beep.SYS 28672 bytes (Microsoft Corporation, BEEP Driver)
0x93F9C000 C:\Windows\system32\DRIVERS\HIDPARSE.SYS 28672 bytes (Microsoft Corporation, Hid Parsing Library)
0x837B1000 C:\Windows\system32\DRIVERS\intelide.sys 28672 bytes (Microsoft Corporation, Intel PCI IDE Driver)
0x8BC1F000 C:\Windows\System32\Drivers\Null.SYS 28672 bytes (Microsoft Corporation, NULL Driver)
0x9E47A000 C:\Windows\system32\DRIVERS\parvdm.sys 28672 bytes (Microsoft Corporation, VDM Parallel Driver)
0x912DD000 C:\Windows\system32\DRIVERS\wfplwf.sys 28672 bytes (Microsoft Corporation, WFP NDIS 6.20 Lightweight Filter Driver)
0x918AC000 C:\Windows\System32\Drivers\avgmfx86.sys 24576 bytes (AVG Technologies CZ, s.r.o., AVG Resident Shield Minifilter Driver)
0x93F78000 C:\Windows\System32\Drivers\LUsbFilt.Sys 24576 bytes (Logitech, Inc., Logitech USB Filter Driver.)
0x91370000 C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS 24576 bytes
0x93FEE000 C:\Windows\system32\DRIVERS\AegisP.sys 20480 bytes (Meetinghouse Data Communications, IEEE 802.1X Protocol Driver)
0x9E4D1000 C:\Windows\system32\DRIVERS\lirsgt.sys 20480 bytes
0x9280D000 C:\Windows\system32\DRIVERS\ss.sys 20480 bytes (WikiTek Inc., StreamSurge Intermediate Miniport Driver)
0x912D9000 C:\Windows\System32\Drivers\aswRdr.SYS 16384 bytes (ALWIL Software, avast! TDI RDR Driver)
0x9E4C4000 C:\Windows\system32\drivers\cpuz132_x32.sys 16384 bytes (Windows (R) Codename Longhorn DDK provider, CPUID Driver)
0x9280B000 C:\Windows\system32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator)
0x93FA3000 C:\Windows\system32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver)
!!!!!!!!!!!Hidden driver: 0x86C52A17 ?_empty_? 1513 bytes
==============================================
>Stealth
==============================================
0x837DC000 WARNING: suspicious driver modification [atapi.sys::0x86C52A17]
0x9CB67F2E Unknown thread object [ ETHREAD 0x86E55BE0 ] , 600 bytes
0x9CA2DF2E Unknown thread object [ ETHREAD 0x87969620 ] , 600 bytes
==============================================
>Files
==============================================
==============================================
>Hooks
==============================================
[1000]svchost.exe-->mswsock.dll+0x00002BBC, Type: Inline - RelativeJump 0x74E12BBC-->00000000 [unknown_code_page]
[1000]svchost.exe-->mswsock.dll+0x000044B1, Type: Inline - RelativeJump 0x74E144B1-->00000000 [unknown_code_page]
[1000]svchost.exe-->mswsock.dll+0x000046B7, Type: Inline - RelativeJump 0x74E146B7-->00000000 [unknown_code_page]
[1000]svchost.exe-->ntdll.dll-->KiUserExceptionDispatcher, Type: Inline - RelativeJump 0x772C6448-->00000000 [unknown_code_page]
[1000]svchost.exe-->ntdll.dll-->NtProtectVirtualMemory, Type: Inline - RelativeJump 0x772C5360-->00000000 [unknown_code_page]
[1000]svchost.exe-->ntdll.dll-->NtWriteVirtualMemory, Type: Inline - RelativeJump 0x772C5EE0-->00000000 [unknown_code_page]
[1000]svchost.exe-->user32.dll-->GetCursorPos, Type: Inline - RelativeJump 0x7597C198-->00000000 [unknown_code_page]
[2328]aim.exe-->advapi32.dll-->kernel32.dll-->LoadLibraryA, Type: IAT modification 0x77C617BC-->00000000 [tbdiag.dll]
[2328]aim.exe-->advapi32.dll-->kernel32.dll-->LoadLibraryExA, Type: IAT modification 0x77C6180C-->00000000 [tbdiag.dll]
[2328]aim.exe-->advapi32.dll-->kernel32.dll-->LoadLibraryExW, Type: IAT modification 0x77C61768-->00000000 [tbdiag.dll]
[2328]aim.exe-->advapi32.dll-->kernel32.dll-->LoadLibraryW, Type: IAT modification 0x77C617D0-->00000000 [tbdiag.dll]
[2328]aim.exe-->advapi32.dll-->kernel32.dll-->SetUnhandledExceptionFilter, Type: IAT modification 0x77C6181C-->00000000 [tbdiag.dll]
[2328]aim.exe-->gdi32.dll-->kernel32.dll-->LoadLibraryA, Type: IAT modification 0x77B61144-->00000000 [tbdiag.dll]
[2328]aim.exe-->gdi32.dll-->kernel32.dll-->LoadLibraryExW, Type: IAT modification 0x77B61138-->00000000 [tbdiag.dll]
[2328]aim.exe-->gdi32.dll-->kernel32.dll-->LoadLibraryW, Type: IAT modification 0x77B611A0-->00000000 [tbdiag.dll]
[2328]aim.exe-->gdi32.dll-->kernel32.dll-->SetUnhandledExceptionFilter, Type: IAT modification 0x77B610E0-->00000000 [tbdiag.dll]
[2328]aim.exe-->shell32.dll-->kernel32.dll-->LoadLibraryA, Type: IAT modification 0x738021BC-->00000000 [tbdiag.dll]
[2328]aim.exe-->shell32.dll-->kernel32.dll-->LoadLibraryW, Type: IAT modification 0x73802248-->00000000 [tbdiag.dll]
[2328]aim.exe-->user32.dll-->kernel32.dll-->LoadLibraryExA, Type: IAT modification 0x77D11490-->00000000 [tbdiag.dll]
[2328]aim.exe-->user32.dll-->kernel32.dll-->LoadLibraryExW, Type: IAT modification 0x77D11398-->00000000 [tbdiag.dll]
[2328]aim.exe-->user32.dll-->kernel32.dll-->LoadLibraryW, Type: IAT modification 0x77D114E4-->00000000 [tbdiag.dll]
[2328]aim.exe-->user32.dll-->kernel32.dll-->SetUnhandledExceptionFilter, Type: IAT modification 0x77D114A0-->00000000 [tbdiag.dll]
[2328]aim.exe-->wininet.dll-->advapi32.dll-->RegOpenKeyExW, Type: IAT modification 0x71201268-->00000000 [aim.exe]
[2328]aim.exe-->wininet.dll-->advapi32.dll-->RegQueryValueExA, Type: IAT modification 0x71201290-->00000000 [aim.exe]
[2328]aim.exe-->wininet.dll-->kernel32.dll-->LoadLibraryA, Type: IAT modification 0x71201450-->00000000 [tbdiag.dll]
[2328]aim.exe-->wininet.dll-->kernel32.dll-->LoadLibraryExW, Type: IAT modification 0x712013D4-->00000000 [tbdiag.dll]
[2328]aim.exe-->wininet.dll-->kernel32.dll-->LoadLibraryW, Type: IAT modification 0x71201398-->00000000 [tbdiag.dll]
[2328]aim.exe-->wininet.dll-->kernel32.dll-->SetUnhandledExceptionFilter, Type: IAT modification 0x712013C8-->00000000 [tbdiag.dll]
[2328]aim.exe-->wsock32.dll-->kernel32.dll-->SetUnhandledExceptionFilter, Type: IAT modification 0x3FD11040-->00000000 [tbdiag.dll]
[2392]explorer.exe-->mswsock.dll+0x00002BBC, Type: Inline - RelativeJump 0x74E12BBC-->00000000 [unknown_code_page]
[2392]explorer.exe-->mswsock.dll+0x000044B1, Type: Inline - RelativeJump 0x74E144B1-->00000000 [unknown_code_page]
[2392]explorer.exe-->mswsock.dll+0x000046B7, Type: Inline - RelativeJump 0x74E146B7-->00000000 [unknown_code_page]
[2392]explorer.exe-->ntdll.dll-->KiUserExceptionDispatcher, Type: Inline - RelativeJump 0x772C6448-->00000000 [unknown_code_page]
[2392]explorer.exe-->ntdll.dll-->NtProtectVirtualMemory, Type: Inline - RelativeJump 0x772C5360-->00000000 [unknown_code_page]
[2392]explorer.exe-->ntdll.dll-->NtWriteVirtualMemory, Type: Inline - RelativeJump 0x772C5EE0-->00000000 [unknown_code_page]
[3308]plugin-container.exe-->user32.dll-->TrackPopupMenu, Type: Inline - RelativeJump 0x759A4B3B-->00000000 [xul.dll]
[3876]firefox.exe-->mswsock.dll+0x00002BBC, Type: Inline - RelativeJump 0x74E12BBC-->00000000 [unknown_code_page]
[3876]firefox.exe-->mswsock.dll+0x000044B1, Type: Inline - RelativeJump 0x74E144B1-->00000000 [unknown_code_page]
[3876]firefox.exe-->mswsock.dll+0x000046B7, Type: Inline - RelativeJump 0x74E146B7-->00000000 [unknown_code_page]
[3876]firefox.exe-->ntdll.dll-->KiUserExceptionDispatcher, Type: Inline - RelativeJump 0x772C6448-->00000000 [unknown_code_page]
[3876]firefox.exe-->ntdll.dll-->LdrLoadDll, Type: Inline - RelativeJump 0x772DF585-->00000000 [firefox.exe]
[3876]firefox.exe-->ntdll.dll-->NtProtectVirtualMemory, Type: Inline - RelativeJump 0x772C5360-->00000000 [unknown_code_page]
[3876]firefox.exe-->ntdll.dll-->NtWriteVirtualMemory, Type: Inline - RelativeJump 0x772C5EE0-->00000000 [unknown_code_page]
[3960]rundll32.exe-->advapi32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x77C617B8-->00000000 [apphelp.dll]
[3960]rundll32.exe-->gdi32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x77B611B8-->00000000 [apphelp.dll]
[3960]rundll32.exe-->user32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x77D114E0-->00000000 [apphelp.dll]
[3960]rundll32.exe-->wininet.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x7120144C-->00000000 [apphelp.dll]
[700]a2service.exe-->kernel32.dll-->CreateThread, Type: IAT modification 0x00555D80-->00000000 [a2service.exe]
[700]a2service.exe-->kernel32.dll-->CreateThread, Type: IAT modification 0x005564B0-->00000000 [a2service.exe]
[700]a2service.exe-->shell32.dll-->kernel32.dll-->QueueUserWorkItem, Type: IAT modification 0x738021C8-->00000000 [a2service.exe]
[700]a2service.exe-->user32.dll-->kernel32.dll-->CreateThread, Type: IAT modification 0x77D113B0-->00000000 [a2service.exe]
[700]a2service.exe-->wininet.dll-->kernel32.dll-->CreateThread, Type: IAT modification 0x71201360-->00000000 [a2service.exe]


!!POSSIBLE ROOTKIT ACTIVITY DETECTED!! =)

Please download TDSSKiller from here and save it to your Desktop.

• Doubleclick TDSSKiller.exe to run the tool
  
• Click the Start Scan button
  
• After the scan has finished, click the Close button
  
• Click the Report button and copy/paste the contents of it into your next reply

Note:It will also create a log in the C:\ directory.

2010/08/11 14:43:40.0424 TDSS rootkit removing tool 2.4.1.1 Aug 10 2010 14:48:09
2010/08/11 14:43:40.0424 ================================================================================
2010/08/11 14:43:40.0424 SystemInfo:
2010/08/11 14:43:40.0424
2010/08/11 14:43:40.0424 OS Version: 6.1.7600 ServicePack: 0.0
2010/08/11 14:43:40.0424 Product type: Workstation
2010/08/11 14:43:40.0424 ComputerName: CHAN-PC
2010/08/11 14:43:40.0426 UserName: Chan
2010/08/11 14:43:40.0426 Windows directory: C:\Windows
2010/08/11 14:43:40.0426 System windows directory: C:\Windows
2010/08/11 14:43:40.0426 Processor architecture: Intel x86
2010/08/11 14:43:40.0426 Number of processors: 4
2010/08/11 14:43:40.0426 Page size: 0x1000
2010/08/11 14:43:40.0426 Boot type: Normal boot
2010/08/11 14:43:40.0426 ================================================================================
2010/08/11 14:43:40.0600 Initialize success
2010/08/11 14:43:42.0135 ================================================================================
2010/08/11 14:43:42.0135 Scan started
2010/08/11 14:43:42.0135 Mode: Manual;
2010/08/11 14:43:42.0135 ================================================================================
2010/08/11 14:43:42.0927 1394ohci (6d2aca41739bfe8cb86ee8e85f29697d) C:\Windows\system32\DRIVERS\1394ohci.sys
2010/08/11 14:43:42.0975 a016bus (b021d0ae4605ce5df67f06e741278cdf) C:\Windows\system32\DRIVERS\a016bus.sys
2010/08/11 14:43:43.0018 a016mdfl (5b6bc2de851012906d4aae84c802e3f2) C:\Windows\system32\DRIVERS\a016mdfl.sys
2010/08/11 14:43:43.0046 a016mdm (c80cffb5819ccfc97f2b09e2259dfde6) C:\Windows\system32\DRIVERS\a016mdm.sys
2010/08/11 14:43:43.0060 a016mgmt (415243177ff67d3cfba44d931b809bf3) C:\Windows\system32\DRIVERS\a016mgmt.sys
2010/08/11 14:43:43.0074 a016obex (3a853f9b8b69541cde714a83a0a6434e) C:\Windows\system32\DRIVERS\a016obex.sys
2010/08/11 14:43:43.0156 a2acc (130638992f393300a81e68c56456c533) C:\PROGRAM FILES\EMSISOFT ANTI-MALWARE\a2accx86.sys
2010/08/11 14:43:43.0201 a2injectiondriver (7c6a7d5b8fc465b976902d0af2f8effd) C:\Program Files\Emsisoft Anti-Malware\a2dix86.sys
2010/08/11 14:43:43.0229 a2util (2da26eb05b5495d3b2ee36456c239fb7) C:\Program Files\Emsisoft Anti-Malware\a2util32.sys
2010/08/11 14:43:43.0299 ACPI (f0e07d144c8685b8774bc32fc8da4df0) C:\Windows\system32\DRIVERS\ACPI.sys
2010/08/11 14:43:43.0331 AcpiPmi (98d81ca942d19f7d9153b095162ac013) C:\Windows\system32\DRIVERS\acpipmi.sys
2010/08/11 14:43:43.0370 adp94xx (21e785ebd7dc90a06391141aac7892fb) C:\Windows\system32\DRIVERS\adp94xx.sys
2010/08/11 14:43:43.0401 adpahci (0c676bc278d5b59ff5abd57bbe9123f2) C:\Windows\system32\DRIVERS\adpahci.sys
2010/08/11 14:43:43.0434 adpu320 (7c7b5ee4b7b822ec85321fe23a27db33) C:\Windows\system32\DRIVERS\adpu320.sys
2010/08/11 14:43:43.0469 AegisP (2f7f3e8da380325866e566f5d5ec23d5) C:\Windows\system32\DRIVERS\AegisP.sys
2010/08/11 14:43:43.0522 AFD (ddc040fdb01ef1712a6b13e52afb104c) C:\Windows\system32\drivers\afd.sys
2010/08/11 14:43:43.0553 agp440 (507812c3054c21cef746b6ee3d04dd6e) C:\Windows\system32\DRIVERS\agp440.sys
2010/08/11 14:43:43.0583 aic78xx (8b30250d573a8f6b4bd23195160d8707) C:\Windows\system32\DRIVERS\djsvs.sys
2010/08/11 14:43:43.0635 aliide (0d40bcf52ea90fc7df2aeab6503dea44) C:\Windows\system32\DRIVERS\aliide.sys
2010/08/11 14:43:43.0756 amdagp (3c6600a0696e90a463771c7422e23ab5) C:\Windows\system32\DRIVERS\amdagp.sys
2010/08/11 14:43:43.0795 amdide (cd5914170297126b6266860198d1d4f0) C:\Windows\system32\DRIVERS\amdide.sys
2010/08/11 14:43:43.0836 AmdK8 (00dda200d71bac534bf56a9db5dfd666) C:\Windows\system32\DRIVERS\amdk8.sys
2010/08/11 14:43:44.0135 amdkmdag (51610b74a9a1d84dc86fce1019beaff4) C:\Windows\system32\DRIVERS\atikmdag.sys
2010/08/11 14:43:44.0223 amdkmdap (cd1d86ab81eece67d7bd6f7ef9786ccc) C:\Windows\system32\DRIVERS\atikmpag.sys
2010/08/11 14:43:44.0262 AmdPPM (3cbf30f5370fda40dd3e87df38ea53b6) C:\Windows\system32\DRIVERS\amdppm.sys
2010/08/11 14:43:44.0282 amdsata (2101a86c25c154f8314b24ef49d7fbc2) C:\Windows\system32\DRIVERS\amdsata.sys
2010/08/11 14:43:44.0309 amdsbs (ea43af0c423ff267355f74e7a53bdaba) C:\Windows\system32\DRIVERS\amdsbs.sys
2010/08/11 14:43:44.0349 amdxata (b81c2b5616f6420a9941ea093a92b150) C:\Windows\system32\DRIVERS\amdxata.sys
2010/08/11 14:43:44.0399 AppID (feb834c02ce1e84b6a38f953ca067706) C:\Windows\system32\drivers\appid.sys
2010/08/11 14:43:44.0451 arc (2932004f49677bd84dbc72edb754ffb3) C:\Windows\system32\DRIVERS\arc.sys
2010/08/11 14:43:44.0468 arcsas (5d6f36c46fd283ae1b57bd2e9feb0bc7) C:\Windows\system32\DRIVERS\arcsas.sys
2010/08/11 14:43:44.0534 aswFsBlk (b4079a98f294a3e262872cb76f4849f0) C:\Windows\system32\DRIVERS\aswFsBlk.sys
2010/08/11 14:43:44.0578 aswMonFlt (e2851cb7dbb831888eaea46c55c05e44) C:\Windows\system32\DRIVERS\aswMonFlt.sys
2010/08/11 14:43:44.0611 aswRdr (8080d683489c99cbace813f6fa4069cc) C:\Windows\system32\drivers\aswRdr.sys
2010/08/11 14:43:44.0660 aswSP (2e5a2ad5004b55df39b7606130a88142) C:\Windows\system32\drivers\aswSP.sys
2010/08/11 14:43:44.0717 aswTdi (d4c83a37efadfa2c398362e0776e3773) C:\Windows\system32\drivers\aswTdi.sys
2010/08/11 14:43:44.0751 AsyncMac (add2ade1c2b285ab8378d2daaf991481) C:\Windows\system32\DRIVERS\asyncmac.sys
2010/08/11 14:43:44.0785 atapi (338c86357871c167a96ab976519bf59e) C:\Windows\system32\DRIVERS\atapi.sys
2010/08/11 14:43:44.0813 AtiHdmiService (8df873d0587596c1d35a9cececc61da1) C:\Windows\system32\drivers\AtiHdmi.sys
2010/08/11 14:43:44.0849 atksgt (f0d933b42cd0594048e4d5200ae9e417) C:\Windows\system32\DRIVERS\atksgt.sys
2010/08/11 14:43:44.0999 AvgLdx86 (b8c187439d27aba430dd69fdcf1fa657) C:\Windows\System32\Drivers\avgldx86.sys
2010/08/11 14:43:45.0031 AvgMfx86 (53b3f979930a786a614d29cafe99f645) C:\Windows\System32\Drivers\avgmfx86.sys
2010/08/11 14:43:45.0052 AvgTdiX (22e3b793c3e61720f03d3a22351af410) C:\Windows\System32\Drivers\avgtdix.sys
2010/08/11 14:43:45.0092 b06bdrv (1a231abec60fd316ec54c66715543cec) C:\Windows\system32\DRIVERS\bxvbdx.sys
2010/08/11 14:43:45.0123 b57nd60x (bd8869eb9cde6bbe4508d869929869ee) C:\Windows\system32\DRIVERS\b57nd60x.sys
2010/08/11 14:43:45.0183 Beep (505506526a9d467307b3c393dedaf858) C:\Windows\system32\drivers\Beep.sys
2010/08/11 14:43:45.0266 BKNDIS5 (a40a990e37f6688012c5ad2af2568116) C:\PROGRA~1\Belkin\F5D9050\BKNDIS5.SYS
2010/08/11 14:43:45.0317 blbdrive (2287078ed48fcfc477b05b20cf38f36f) C:\Windows\system32\DRIVERS\blbdrive.sys
2010/08/11 14:43:45.0344 bowser (fcafaef6798d7b51ff029f99a9898961) C:\Windows\system32\DRIVERS\bowser.sys
2010/08/11 14:43:45.0368 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\DRIVERS\BrFiltLo.sys
2010/08/11 14:43:45.0386 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\DRIVERS\BrFiltUp.sys
2010/08/11 14:43:45.0423 Brserid (845b8ce732e67f3b4133164868c666ea) C:\Windows\System32\Drivers\Brserid.sys
2010/08/11 14:43:45.0448 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\System32\Drivers\BrSerWdm.sys
2010/08/11 14:43:45.0471 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\System32\Drivers\BrUsbMdm.sys
2010/08/11 14:43:45.0498 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\System32\Drivers\BrUsbSer.sys
2010/08/11 14:43:45.0525 BTHMODEM (ed3df7c56ce0084eb2034432fc56565a) C:\Windows\system32\DRIVERS\bthmodem.sys
2010/08/11 14:43:45.0673 cdfs (77ea11b065e0a8ab902d78145ca51e10) C:\Windows\system32\DRIVERS\cdfs.sys
2010/08/11 14:43:45.0725 cdrom (ba6e70aa0e6091bc39de29477d866a77) C:\Windows\system32\DRIVERS\cdrom.sys
2010/08/11 14:43:45.0753 circlass (3fe3fe94a34df6fb06e6418d0f6a0060) C:\Windows\system32\DRIVERS\circlass.sys
2010/08/11 14:43:45.0779 CLFS (635181e0e9bbf16871bf5380d71db02d) C:\Windows\system32\CLFS.sys
2010/08/11 14:43:45.0810 CmBatt (dea805815e587dad1dd2c502220b5616) C:\Windows\system32\DRIVERS\CmBatt.sys
2010/08/11 14:43:45.0827 cmdide (c537b1db64d495b9b4717b4d6d9edbf2) C:\Windows\system32\DRIVERS\cmdide.sys
2010/08/11 14:43:45.0861 CNG (1b675691ed940766149c93e8f4488d68) C:\Windows\system32\Drivers\cng.sys
2010/08/11 14:43:45.0881 Compbatt (a6023d3823c37043986713f118a89bee) C:\Windows\system32\DRIVERS\compbatt.sys
2010/08/11 14:43:45.0916 CompositeBus (f1724ba27e97d627f808fb0ba77a28a6) C:\Windows\system32\DRIVERS\CompositeBus.sys
2010/08/11 14:43:45.0980 cpuz132 (097a0a4899b759a4f032bd464963b4be) C:\Windows\system32\drivers\cpuz132_x32.sys
2010/08/11 14:43:46.0014 cpuz133 (13a0d3f9d5f39adaca0a8d3bb327eb31) C:\Windows\system32\drivers\cpuz133_x32.sys
2010/08/11 14:43:46.0046 crcdisk (2c4ebcfc84a9b44f209dff6c6e6c61d1) C:\Windows\system32\DRIVERS\crcdisk.sys
2010/08/11 14:43:46.0093 CSC (27c9490bdd0ae48911ab8cf1932591ed) C:\Windows\system32\drivers\csc.sys
2010/08/11 14:43:46.0173 DfsC (8e09e52ee2e3ceb199ef3dd99cf9e3fb) C:\Windows\system32\Drivers\dfsc.sys
2010/08/11 14:43:46.0197 discache (1a050b0274bfb3890703d490f330c0da) C:\Windows\system32\drivers\discache.sys
2010/08/11 14:43:46.0230 Disk (565003f326f99802e68ca78f2a68e9ff) C:\Windows\system32\DRIVERS\disk.sys
2010/08/11 14:43:46.0272 drmkaud (b918e7c5f9bf77202f89e1a9539f2eb4) C:\Windows\system32\drivers\drmkaud.sys
2010/08/11 14:43:46.0306 DXGKrnl (8b6c3464d7fac176500061dbfff42ad4) C:\Windows\System32\drivers\dxgkrnl.sys
2010/08/11 14:43:46.0418 ebdrv (024e1b5cac09731e4d868e64dbfb4ab0) C:\Windows\system32\DRIVERS\evbdx.sys
2010/08/11 14:43:46.0502 elxstor (0ed67910c8c326796faa00b2bf6d9d3c) C:\Windows\system32\DRIVERS\elxstor.sys
2010/08/11 14:43:46.0559 ErrDev (8fc3208352dd3912c94367a206ab3f11) C:\Windows\system32\DRIVERS\errdev.sys
2010/08/11 14:43:46.0622 exfat (2dc9108d74081149cc8b651d3a26207f) C:\Windows\system32\drivers\exfat.sys
2010/08/11 14:43:46.0654 fastfat (7e0ab74553476622fb6ae36f73d97d35) C:\Windows\system32\drivers\fastfat.sys
2010/08/11 14:43:46.0681 fdc (e817a017f82df2a1f8cfdbda29388b29) C:\Windows\system32\DRIVERS\fdc.sys
2010/08/11 14:43:46.0723 FileInfo (6cf00369c97f3cf563be99be983d13d8) C:\Windows\system32\drivers\fileinfo.sys
2010/08/11 14:43:46.0740 Filetrace (42c51dc94c91da21cb9196eb64c45db9) C:\Windows\system32\drivers\filetrace.sys
2010/08/11 14:43:46.0752 flpydisk (87907aa70cb3c56600f1c2fb8841579b) C:\Windows\system32\DRIVERS\flpydisk.sys
2010/08/11 14:43:46.0796 FltMgr (7520ec808e0c35e0ee6f841294316653) C:\Windows\system32\drivers\fltmgr.sys
2010/08/11 14:43:46.0816 FsDepends (1a16b57943853e598cff37fe2b8cbf1d) C:\Windows\system32\drivers\FsDepends.sys
2010/08/11 14:43:46.0830 Fs_Rec (a574b4360e438977038aae4bf60d79a2) C:\Windows\system32\drivers\Fs_Rec.sys
2010/08/11 14:43:46.0852 fvevol (5592f5dba26282d24d2b080eb438a4d7) C:\Windows\system32\DRIVERS\fvevol.sys
2010/08/11 14:43:46.0879 gagp30kx (65ee0c7a58b65e74ae05637418153938) C:\Windows\system32\DRIVERS\gagp30kx.sys
2010/08/11 14:43:46.0993 ggflt (007aea2e06e7cef7372e40c277163959) C:\Windows\system32\DRIVERS\ggflt.sys
2010/08/11 14:43:47.0034 ggsemc (c73de35960ca75c5ab4ae636b127c64e) C:\Windows\system32\DRIVERS\ggsemc.sys
2010/08/11 14:43:47.0100 hcw85cir (c44e3c2bab6837db337ddee7544736db) C:\Windows\system32\drivers\hcw85cir.sys
2010/08/11 14:43:47.0172 HdAudAddService (3530cad25deba7dc7de8bb51632cbc5f) C:\Windows\system32\drivers\HdAudio.sys
2010/08/11 14:43:47.0214 HDAudBus (717a2207fd6f13ad3e664c7d5a43c7bf) C:\Windows\system32\DRIVERS\HDAudBus.sys
2010/08/11 14:43:47.0242 HidBatt (1d58a7f3e11a9731d0eaaaa8405acc36) C:\Windows\system32\DRIVERS\HidBatt.sys
2010/08/11 14:43:47.0260 HidBth (89448f40e6df260c206a193a4683ba78) C:\Windows\system32\DRIVERS\hidbth.sys
2010/08/11 14:43:47.0302 HidIr (cf50b4cf4a4f229b9f3c08351f99ca5e) C:\Windows\system32\DRIVERS\hidir.sys
2010/08/11 14:43:47.0340 HidUsb (25072fb35ac90b25f9e4e3bacf774102) C:\Windows\system32\DRIVERS\hidusb.sys
2010/08/11 14:43:47.0381 HpSAMD (295fdc419039090eb8b49ffdbb374549) C:\Windows\system32\DRIVERS\HpSAMD.sys
2010/08/11 14:43:47.0421 HTTP (c531c7fd9e8b62021112787c4e2c5a5a) C:\Windows\system32\drivers\HTTP.sys
2010/08/11 14:43:47.0457 hwpolicy (8305f33cde89ad6c7a0763ed0b5a8d42) C:\Windows\system32\drivers\hwpolicy.sys
2010/08/11 14:43:47.0500 i8042prt (f151f0bdc47f4a28b1b20a0818ea36d6) C:\Windows\system32\DRIVERS\i8042prt.sys
2010/08/11 14:43:47.0528 iaStorV (934af4d7c5f457b9f0743f4299b77b67) C:\Windows\system32\DRIVERS\iaStorV.sys
2010/08/11 14:43:47.0628 iirsp (4173ff5708f3236cf25195fecd742915) C:\Windows\system32\DRIVERS\iirsp.sys
2010/08/11 14:43:47.0717 IntcAzAudAddService (2a4eb3167a071a67d3f56e94663544ec) C:\Windows\system32\drivers\RTKVHDA.sys
2010/08/11 14:43:47.0777 intelide (a0f12f2c9ba6c72f3987ce780e77c130) C:\Windows\system32\DRIVERS\intelide.sys
2010/08/11 14:43:47.0807 intelppm (3b514d27bfc4accb4037bc6685f766e0) C:\Windows\system32\DRIVERS\intelppm.sys
2010/08/11 14:43:47.0836 IpFilterDriver (709d1761d3b19a932ff0238ea6d50200) C:\Windows\system32\DRIVERS\ipfltdrv.sys
2010/08/11 14:43:47.0870 IPMIDRV (e4454b6c37d7ffd5649611f6496308a7) C:\Windows\system32\DRIVERS\IPMIDrv.sys
2010/08/11 14:43:47.0897 IPNAT (a5fa468d67abcdaa36264e463a7bb0cd) C:\Windows\system32\drivers\ipnat.sys
2010/08/11 14:43:47.0937 IRENUM (42996cff20a3084a56017b7902307e9f) C:\Windows\system32\drivers\irenum.sys
2010/08/11 14:43:47.0963 isapnp (1f32bb6b38f62f7df1a7ab7292638a35) C:\Windows\system32\DRIVERS\isapnp.sys
2010/08/11 14:43:47.0992 iScsiPrt (ed46c223ae46c6866ab77cdc41c404b7) C:\Windows\system32\DRIVERS\msiscsi.sys
2010/08/11 14:43:48.0017 kbdclass (adef52ca1aeae82b50df86b56413107e) C:\Windows\system32\DRIVERS\kbdclass.sys
2010/08/11 14:43:48.0034 kbdhid (3d9f0ebf350edcfd6498057301455964) C:\Windows\system32\DRIVERS\kbdhid.sys
2010/08/11 14:43:48.0065 KSecDD (e36a061ec11b373826905b21be10948f) C:\Windows\system32\Drivers\ksecdd.sys
2010/08/11 14:43:48.0087 KSecPkg (365c6154bbbc5377173f1ca7bfb6cc59) C:\Windows\system32\Drivers\ksecpkg.sys
2010/08/11 14:43:48.0126 L1C (a158cea8644b8a5c1ec0e9a81b70f65a) C:\Windows\system32\DRIVERS\L1C62x86.sys
2010/08/11 14:43:48.0158 L8042Kbd (0c6e346cde730cf1356dd69ad6e9bc42) C:\Windows\system32\DRIVERS\L8042Kbd.sys
2010/08/11 14:43:48.0207 LHidFilt (7f9c7b28cf1c859e1c42619eea946dc8) C:\Windows\system32\DRIVERS\LHidFilt.Sys
2010/08/11 14:43:48.0243 lirsgt (f8a7212d0864ef5e9185fb95e6623f4d) C:\Windows\system32\DRIVERS\lirsgt.sys
2010/08/11 14:43:48.0280 lltdio (f7611ec07349979da9b0ae1f18ccc7a6) C:\Windows\system32\DRIVERS\lltdio.sys
2010/08/11 14:43:48.0323 LMouFilt (ab33792a87285344f43b5ce23421bab0) C:\Windows\system32\DRIVERS\LMouFilt.Sys
2010/08/11 14:43:48.0363 LSI_FC (eb119a53ccf2acc000ac71b065b78fef) C:\Windows\system32\DRIVERS\lsi_fc.sys
2010/08/11 14:43:48.0382 LSI_SAS (8ade1c877256a22e49b75d1cc9161f9c) C:\Windows\system32\DRIVERS\lsi_sas.sys
2010/08/11 14:43:48.0404 LSI_SAS2 (dc9dc3d3daa0e276fd2ec262e38b11e9) C:\Windows\system32\DRIVERS\lsi_sas2.sys
2010/08/11 14:43:48.0431 LSI_SCSI (0a036c7d7cab643a7f07135ac47e0524) C:\Windows\system32\DRIVERS\lsi_scsi.sys
2010/08/11 14:43:48.0469 luafv (6703e366cc18d3b6e534f5cf7df39cee) C:\Windows\system32\drivers\luafv.sys
2010/08/11 14:43:48.0487 LUsbFilt (77030525cd86a93f1af34fa9b96d33ce) C:\Windows\system32\Drivers\LUsbFilt.Sys
2010/08/11 14:43:48.0515 MBAMProtector (67b48a903430c6d4fb58cbaca1866601) C:\Windows\system32\drivers\mbam.sys
2010/08/11 14:43:48.0562 megasas (0fff5b045293002ab38eb1fd1fc2fb74) C:\Windows\system32\DRIVERS\megasas.sys
2010/08/11 14:43:48.0609 MegaSR (dcbab2920c75f390caf1d29f675d03d6) C:\Windows\system32\DRIVERS\MegaSR.sys
2010/08/11 14:43:48.0645 Modem (f001861e5700ee84e2d4e52c712f4964) C:\Windows\system32\drivers\modem.sys
2010/08/11 14:43:48.0686 monitor (79d10964de86b292320e9dfe02282a23) C:\Windows\system32\DRIVERS\monitor.sys
2010/08/11 14:43:48.0713 mouclass (fb18cc1d4c2e716b6b903b0ac0cc0609) C:\Windows\system32\DRIVERS\mouclass.sys
2010/08/11 14:43:48.0744 mouhid (2c388d2cd01c9042596cf3c8f3c7b24d) C:\Windows\system32\DRIVERS\mouhid.sys
2010/08/11 14:43:48.0766 mountmgr (921c18727c5920d6c0300736646931c2) C:\Windows\system32\drivers\mountmgr.sys
2010/08/11 14:43:48.0805 mpio (2af5997438c55fb79d33d015c30e1974) C:\Windows\system32\DRIVERS\mpio.sys
2010/08/11 14:43:48.0832 mpsdrv (ad2723a7b53dd1aacae6ad8c0bfbf4d0) C:\Windows\system32\drivers\mpsdrv.sys
2010/08/11 14:43:48.0865 MRxDAV (b1be47008d20e43da3adc37c24cdb89d) C:\Windows\system32\drivers\mrxdav.sys
2010/08/11 14:43:48.0918 mrxsmb (f1b6aa08497ea86ca6ef6f7a08b0bfb8) C:\Windows\system32\DRIVERS\mrxsmb.sys
2010/08/11 14:43:48.0942 mrxsmb10 (5613358b4050f46f5a9832da8050d6e4) C:\Windows\system32\DRIVERS\mrxsmb10.sys
2010/08/11 14:43:48.0965 mrxsmb20 (25c9792778d80feb4c8201e62281bfdf) C:\Windows\system32\DRIVERS\mrxsmb20.sys
2010/08/11 14:43:48.0998 msahci (4326d168944123f38dd3b2d9c37a0b12) C:\Windows\system32\DRIVERS\msahci.sys
2010/08/11 14:43:49.0022 msdsm (455029c7174a2dbb03dba8a0d8bddd9a) C:\Windows\system32\DRIVERS\msdsm.sys
2010/08/11 14:43:49.0073 Msfs (daefb28e3af5a76abcc2c3078c07327f) C:\Windows\system32\drivers\Msfs.sys
2010/08/11 14:43:49.0087 mshidkmdf (3e1e5767043c5af9367f0056295e9f84) C:\Windows\System32\drivers\mshidkmdf.sys
2010/08/11 14:43:49.0110 msisadrv (0a4e5757ae09fa9622e3158cc1aef114) C:\Windows\system32\DRIVERS\msisadrv.sys
2010/08/11 14:43:49.0155 MSKSSRV (8c0860d6366aaffb6c5bb9df9448e631) C:\Windows\system32\drivers\MSKSSRV.sys
2010/08/11 14:43:49.0177 MSPCLOCK (3ea8b949f963562cedbb549eac0c11ce) C:\Windows\system32\drivers\MSPCLOCK.sys
2010/08/11 14:43:49.0197 MSPQM (f456e973590d663b1073e9c463b40932) C:\Windows\system32\drivers\MSPQM.sys
2010/08/11 14:43:49.0221 MsRPC (0e008fc4819d238c51d7c93e7b41e560) C:\Windows\system32\drivers\MsRPC.sys
2010/08/11 14:43:49.0243 mssmbios (fc6b9ff600cc585ea38b12589bd4e246) C:\Windows\system32\DRIVERS\mssmbios.sys
2010/08/11 14:43:49.0280 MSTEE (b42c6b921f61a6e55159b8be6cd54a36) C:\Windows\system32\drivers\MSTEE.sys
2010/08/11 14:43:49.0299 MTConfig (33599130f44e1f34631cea241de8ac84) C:\Windows\system32\DRIVERS\MTConfig.sys
2010/08/11 14:43:49.0326 Mup (159fad02f64e6381758c990f753bcc80) C:\Windows\system32\Drivers\mup.sys
2010/08/11 14:43:49.0373 NativeWifiP (26384429fcd85d83746f63e798ab1480) C:\Windows\system32\DRIVERS\nwifi.sys
2010/08/11 14:43:49.0412 NDIS (23759d175a0a9baaf04d05047bc135a8) C:\Windows\system32\drivers\ndis.sys
2010/08/11 14:43:49.0472 NdisCap (0e1787aa6c9191d3d319e8bafe86f80c) C:\Windows\system32\DRIVERS\ndiscap.sys
2010/08/11 14:43:49.0503 NdisTapi (e4a8aec125a2e43a9e32afeea7c9c888) C:\Windows\system32\DRIVERS\ndistapi.sys
2010/08/11 14:43:49.0528 Ndisuio (b30ae7f2b6d7e343b0df32e6c08fce75) C:\Windows\system32\DRIVERS\ndisuio.sys
2010/08/11 14:43:49.0545 NdisWan (267c415eadcbe53c9ca873dee39cf3a4) C:\Windows\system32\DRIVERS\ndiswan.sys
2010/08/11 14:43:49.0563 NDProxy (af7e7c63dcef3f8772726f86039d6eb4) C:\Windows\system32\drivers\NDProxy.sys
2010/08/11 14:43:49.0593 NetBIOS (80b275b1ce3b0e79909db7b39af74d51) C:\Windows\system32\DRIVERS\netbios.sys
2010/08/11 14:43:49.0616 NetBT (dd52a733bf4ca5af84562a5e2f963b91) C:\Windows\system32\DRIVERS\netbt.sys
2010/08/11 14:43:49.0681 netr73 (fbbdcacbc128670983cca59345be5454) C:\Windows\system32\DRIVERS\netr73.sys
2010/08/11 14:43:49.0731 nfrd960 (1d85c4b390b0ee09c7a46b91efb2c097) C:\Windows\system32\DRIVERS\nfrd960.sys
2010/08/11 14:43:49.0781 Npfs (1db262a9f8c087e8153d89bef3d2235f) C:\Windows\system32\drivers\Npfs.sys
2010/08/11 14:43:49.0832 nsiproxy (e9a0a4d07e53d8fea2bb8387a3293c58) C:\Windows\system32\drivers\nsiproxy.sys
2010/08/11 14:43:49.0865 Ntfs (3795dcd21f740ee799fb7223234215af) C:\Windows\system32\drivers\Ntfs.sys
2010/08/11 14:43:49.0928 Null (f9756a98d69098dca8945d62858a812c) C:\Windows\system32\drivers\Null.sys
2010/08/11 14:43:50.0123 nvlddmkm (c8cb6135884cbc2a10225c4c3cef0f95) C:\Windows\system32\DRIVERS\nvlddmkm.sys
2010/08/11 14:43:50.0330 nvoclock (96c5900331bd17344f338d006888bae5) C:\Windows\system32\DRIVERS\nvoclock.sys
2010/08/11 14:43:50.0371 nvraid (3f3d04b1d08d43c16ea7963954ec768d) C:\Windows\system32\DRIVERS\nvraid.sys
2010/08/11 14:43:50.0397 nvstor (c99f251a5de63c6f129cf71933aced0f) C:\Windows\system32\DRIVERS\nvstor.sys
2010/08/11 14:43:50.0446 nv_agp (5a0983915f02bae73267cc2a041f717d) C:\Windows\system32\DRIVERS\nv_agp.sys
2010/08/11 14:43:50.0468 ohci1394 (08a70a1f2cdde9bb49b885cb817a66eb) C:\Windows\system32\DRIVERS\ohci1394.sys
2010/08/11 14:43:50.0529 Parport (2ea877ed5dd9713c5ac74e8ea7348d14) C:\Windows\system32\DRIVERS\parport.sys
2010/08/11 14:43:50.0563 partmgr (ff4218952b51de44fe910953a3e686b9) C:\Windows\system32\drivers\partmgr.sys
2010/08/11 14:43:50.0583 Parvdm (eb0a59f29c19b86479d36b35983daadc) C:\Windows\system32\DRIVERS\parvdm.sys
2010/08/11 14:43:50.0610 pci (c858cb77c577780ecc456a892e7e7d0f) C:\Windows\system32\DRIVERS\pci.sys
2010/08/11 14:43:50.0638 pciide (afe86f419014db4e5593f69ffe26ce0a) C:\Windows\system32\DRIVERS\pciide.sys
2010/08/11 14:43:50.0667 pcmcia (f396431b31693e71e8a80687ef523506) C:\Windows\system32\DRIVERS\pcmcia.sys
2010/08/11 14:43:50.0700 pcw (250f6b43d2b613172035c6747aeeb19f) C:\Windows\system32\drivers\pcw.sys
2010/08/11 14:43:50.0729 PEAUTH (9e0104ba49f4e6973749a02bf41344ed) C:\Windows\system32\drivers\peauth.sys
2010/08/11 14:43:50.0814 PptpMiniport (631e3e205ad6d86f2aed6a4a8e69f2db) C:\Windows\system32\DRIVERS\raspptp.sys
2010/08/11 14:43:50.0834 Processor (85b1e3a0c7585bc4aae6899ec6fcf011) C:\Windows\system32\DRIVERS\processr.sys
2010/08/11 14:43:50.0888 Psched (6270ccae2a86de6d146529fe55b3246a) C:\Windows\system32\DRIVERS\pacer.sys
2010/08/11 14:43:50.0938 ql2300 (ab95ecf1f6659a60ddc166d8315b0751) C:\Windows\system32\DRIVERS\ql2300.sys
2010/08/11 14:43:51.0006 ql40xx (b4dd51dd25182244b86737dc51af2270) C:\Windows\system32\DRIVERS\ql40xx.sys
2010/08/11 14:43:51.0038 QWAVEdrv (584078ca1b95ca72df2a27c336f9719d) C:\Windows\system32\drivers\qwavedrv.sys
2010/08/11 14:43:51.0055 RasAcd (30a81b53c766d0133bb86d234e5556ab) C:\Windows\system32\DRIVERS\rasacd.sys
2010/08/11 14:43:51.0091 RasAgileVpn (57ec4aef73660166074d8f7f31c0d4fd) C:\Windows\system32\DRIVERS\AgileVpn.sys
2010/08/11 14:43:51.0110 Rasl2tp (d9f91eafec2815365cbe6d167e4e332a) C:\Windows\system32\DRIVERS\rasl2tp.sys
2010/08/11 14:43:51.0142 RasPppoe (0fe8b15916307a6ac12bfb6a63e45507) C:\Windows\system32\DRIVERS\raspppoe.sys
2010/08/11 14:43:51.0171 RasSstp (44101f495a83ea6401d886e7fd70096b) C:\Windows\system32\DRIVERS\rassstp.sys
2010/08/11 14:43:51.0204 rdbss (835d7e81bf517a3b72384bdcc85e1ce6) C:\Windows\system32\DRIVERS\rdbss.sys
2010/08/11 14:43:51.0223 rdpbus (0d8f05481cb76e70e1da06ee9f0da9df) C:\Windows\system32\DRIVERS\rdpbus.sys
2010/08/11 14:43:51.0244 RDPCDD (1e016846895b15a99f9a176a05029075) C:\Windows\system32\DRIVERS\RDPCDD.sys
2010/08/11 14:43:51.0277 RDPDR (c5ff95883ffef704d50c40d21cfb3ab5) C:\Windows\system32\drivers\rdpdr.sys
2010/08/11 14:43:51.0306 RDPENCDD (5a53ca1598dd4156d44196d200c94b8a) C:\Windows\system32\drivers\rdpencdd.sys
2010/08/11 14:43:51.0354 RDPREFMP (44b0a53cd4f27d50ed461dae0c0b4e1f) C:\Windows\system32\drivers\rdprefmp.sys
2010/08/11 14:43:51.0384 RDPWD (801371ba9782282892d00aadb08ee367) C:\Windows\system32\drivers\RDPWD.sys
2010/08/11 14:43:51.0419 rdyboost (4ea225bf1cf05e158853f30a99ca29a7) C:\Windows\system32\drivers\rdyboost.sys
2010/08/11 14:43:51.0471 rspndr (032b0d36ad92b582d869879f5af5b928) C:\Windows\system32\DRIVERS\rspndr.sys
2010/08/11 14:43:51.0513 RT73 (7436bfd3a542cf6ff55097200031b293) C:\Windows\system32\DRIVERS\rt73.sys
2010/08/11 14:43:51.0574 s0016bus (59509ad6cbc28f2c73056268985b3e48) C:\Windows\system32\DRIVERS\s0016bus.sys
2010/08/11 14:43:51.0611 s0016mdfl (b98c3a6f91f4fba285af9606a240c6b4) C:\Windows\system32\DRIVERS\s0016mdfl.sys
2010/08/11 14:43:51.0639 s0016mdm (8a83426f4fb7b5212825d9de76368b1a) C:\Windows\system32\DRIVERS\s0016mdm.sys
2010/08/11 14:43:51.0686 s0016mgmt (7a78bba97feb5e6d24c49e93a3bf7287) C:\Windows\system32\DRIVERS\s0016mgmt.sys
2010/08/11 14:43:51.0716 s0016nd5 (34ef7b5f611957b73e7219dd5a222ad1) C:\Windows\system32\DRIVERS\s0016nd5.sys
2010/08/11 14:43:51.0752 s0016obex (36792935847143e4a3cda0dc87248487) C:\Windows\system32\DRIVERS\s0016obex.sys
2010/08/11 14:43:51.0780 s0016unic (927208754fb27fc3e7a659e77500c5d1) C:\Windows\system32\DRIVERS\s0016unic.sys
2010/08/11 14:43:51.0822 s3cap (5423d8437051e89dd34749f242c98648) C:\Windows\system32\DRIVERS\vms3cap.sys
2010/08/11 14:43:51.0875 sbp2port (34ee0c44b724e3e4ce2eff29126de5b5) C:\Windows\system32\DRIVERS\sbp2port.sys
2010/08/11 14:43:51.0942 scfilter (a95c54b2ac3cc9c73fcdf9e51a1d6b51) C:\Windows\system32\DRIVERS\scfilter.sys
2010/08/11 14:43:51.0978 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
2010/08/11 14:43:52.0011 Serenum (9ad8b8b515e3df6acd4212ef465de2d1) C:\Windows\system32\DRIVERS\serenum.sys
2010/08/11 14:43:52.0040 Serial (5fb7fcea0490d821f26f39cc5ea3d1e2) C:\Windows\system32\DRIVERS\serial.sys
2010/08/11 14:43:52.0058 sermouse (79bffb520327ff916a582dfea17aa813) C:\Windows\system32\DRIVERS\sermouse.sys
2010/08/11 14:43:52.0091 sffdisk (9f976e1eb233df46fce808d9dea3eb9c) C:\Windows\system32\DRIVERS\sffdisk.sys
2010/08/11 14:43:52.0118 sffp_mmc (932a68ee27833cfd57c1639d375f2731) C:\Windows\system32\DRIVERS\sffp_mmc.sys
2010/08/11 14:43:52.0165 sffp_sd (4f1e5b0fe7c8050668dbfade8999aefb) C:\Windows\system32\DRIVERS\sffp_sd.sys
2010/08/11 14:43:52.0194 sfloppy (db96666cc8312ebc45032f30b007a547) C:\Windows\system32\DRIVERS\sfloppy.sys
2010/08/11 14:43:52.0238 sisagp (2565cac0dc9fe0371bdce60832582b2e) C:\Windows\system32\DRIVERS\sisagp.sys
2010/08/11 14:43:52.0293 SiSRaid2 (a9f0486851becb6dda1d89d381e71055) C:\Windows\system32\DRIVERS\SiSRaid2.sys
2010/08/11 14:43:52.0316 SiSRaid4 (3727097b55738e2f554972c3be5bc1aa) C:\Windows\system32\DRIVERS\sisraid4.sys
2010/08/11 14:43:52.0358 Smb (3e21c083b8a01cb70ba1f09303010fce) C:\Windows\system32\DRIVERS\smb.sys
2010/08/11 14:43:52.0430 spldr (95cf1ae7527fb70f7816563cbc09d942) C:\Windows\system32\drivers\spldr.sys
2010/08/11 14:43:52.0513 sptd (cdddec541bc3c96f91ecb48759673505) C:\Windows\system32\Drivers\sptd.sys
2010/08/11 14:43:52.0567 srv (50a83ca406c808bd35ac9141a0c7618f) C:\Windows\system32\DRIVERS\srv.sys
2010/08/11 14:43:52.0605 srv2 (dce7e10feaabd4cae95948b3de5340bb) C:\Windows\system32\DRIVERS\srv2.sys
2010/08/11 14:43:52.0628 srvnet (bd1433a32792fd0dc450479094fc435a) C:\Windows\system32\DRIVERS\srvnet.sys
2010/08/11 14:43:52.0690 stexstor (db32d325c192b801df274bfd12a7e72b) C:\Windows\system32\DRIVERS\stexstor.sys
2010/08/11 14:43:52.0732 storflt (957e346ca948668f2496a6ccf6ff82cc) C:\Windows\system32\DRIVERS\vmstorfl.sys
2010/08/11 14:43:52.0755 storvsc (d5751969dc3e4b88bf482ac8ec9fe019) C:\Windows\system32\DRIVERS\storvsc.sys
2010/08/11 14:43:52.0800 StreamSurge (21017e14e92b65f157ae30be7badaf5e) C:\Windows\system32\DRIVERS\ss.sys
2010/08/11 14:43:52.0818 swenum (e58c78a848add9610a4db6d214af5224) C:\Windows\system32\DRIVERS\swenum.sys
2010/08/11 14:43:52.0878 Tcpip (2cc3d75488abd3ec628bbb9a4fc84efc) C:\Windows\system32\drivers\tcpip.sys
2010/08/11 14:43:52.0944 TCPIP6 (2cc3d75488abd3ec628bbb9a4fc84efc) C:\Windows\system32\DRIVERS\tcpip.sys
2010/08/11 14:43:52.0970 tcpipreg (e64444523add154f86567c469bc0b17f) C:\Windows\system32\drivers\tcpipreg.sys
2010/08/11 14:43:52.0994 TDPIPE (1875c1490d99e70e449e3afae9fcbadf) C:\Windows\system32\drivers\tdpipe.sys
2010/08/11 14:43:53.0012 TDTCP (7551e91ea999ee9a8e9c331d5a9c31f3) C:\Windows\system32\drivers\tdtcp.sys
2010/08/11 14:43:53.0037 tdx (cb39e896a2a83702d1737bfd402b3542) C:\Windows\system32\DRIVERS\tdx.sys
2010/08/11 14:43:53.0059 TermDD (c36f41ee20e6999dbf4b0425963268a5) C:\Windows\system32\DRIVERS\termdd.sys
2010/08/11 14:43:53.0107 tssecsrv (98ae6fa07d12cb4ec5cf4a9bfa5f4242) C:\Windows\system32\DRIVERS\tssecsrv.sys
2010/08/11 14:43:53.0137 tunnel (3e461d890a97f9d4c168f5fda36e1d00) C:\Windows\system32\DRIVERS\tunnel.sys
2010/08/11 14:43:53.0168 uagp35 (750fbcb269f4d7dd2e420c56b795db6d) C:\Windows\system32\DRIVERS\uagp35.sys
2010/08/11 14:43:53.0198 udfs (09cc3e16f8e5ee7168e01cf8fcbe061a) C:\Windows\system32\DRIVERS\udfs.sys
2010/08/11 14:43:53.0241 uliagpkx (44e8048ace47befbfdc2e9be4cbc8880) C:\Windows\system32\DRIVERS\uliagpkx.sys
2010/08/11 14:43:53.0270 umbus (049b3a50b3d646baeeee9eec9b0668dc) C:\Windows\system32\DRIVERS\umbus.sys
2010/08/11 14:43:53.0300 UmPass (7550ad0c6998ba1cb4843e920ee0feac) C:\Windows\system32\DRIVERS\umpass.sys
2010/08/11 14:43:53.0362 usbaudio (2436a42aab4ad48a9b714e5b0f344627) C:\Windows\system32\drivers\usbaudio.sys
2010/08/11 14:43:53.0384 usbccgp (8455c4ed038efd09e99327f9d2d48ffa) C:\Windows\system32\DRIVERS\usbccgp.sys
2010/08/11 14:43:53.0410 usbcir (04ec7cec62ec3b6d9354eee93327fc82) C:\Windows\system32\DRIVERS\usbcir.sys
2010/08/11 14:43:53.0450 usbehci (1c333bfd60f2fed2c7ad5daf533cb742) C:\Windows\system32\DRIVERS\usbehci.sys
2010/08/11 14:43:53.0469 usbhub (ee6ef93ccfa94fae8c6ab298273d8ae2) C:\Windows\system32\DRIVERS\usbhub.sys
2010/08/11 14:43:53.0491 usbohci (a6fb7957ea7afb1165991e54ce934b74) C:\Windows\system32\DRIVERS\usbohci.sys
2010/08/11 14:43:53.0532 usbprint (797d862fe0875e75c7cc4c1ad7b30252) C:\Windows\system32\DRIVERS\usbprint.sys
2010/08/11 14:43:53.0625 USBSTOR (d8889d56e0d27e57ed4591837fe71d27) C:\Windows\system32\DRIVERS\USBSTOR.SYS
2010/08/11 14:43:53.0654 usbuhci (78780c3ebce17405b1ccd07a3a8a7d72) C:\Windows\system32\DRIVERS\usbuhci.sys
2010/08/11 14:43:53.0703 vdrvroot (a059c4c3edb09e07d21a8e5c0aabd3cb) C:\Windows\system32\DRIVERS\vdrvroot.sys
2010/08/11 14:43:53.0775 vga (17c408214ea61696cec9c66e388b14f3) C:\Windows\system32\DRIVERS\vgapnp.sys
2010/08/11 14:43:53.0803 VgaSave (8e38096ad5c8570a6f1570a61e251561) C:\Windows\System32\drivers\vga.sys
2010/08/11 14:43:53.0833 vhdmp (3be6e1f3a4f1afec8cee0d7883f93583) C:\Windows\system32\DRIVERS\vhdmp.sys
2010/08/11 14:43:53.0877 viaagp (c829317a37b4bea8f39735d4b076e923) C:\Windows\system32\DRIVERS\viaagp.sys
2010/08/11 14:43:53.0902 ViaC7 (e02f079a6aa107f06b16549c6e5c7b74) C:\Windows\system32\DRIVERS\viac7.sys
2010/08/11 14:43:53.0927 viaide (e43574f6a56a0ee11809b48c09e4fd3c) C:\Windows\system32\DRIVERS\viaide.sys
2010/08/11 14:43:53.0948 vmbus (379b349f65f453d2a6e75ea6b7448e49) C:\Windows\system32\DRIVERS\vmbus.sys
2010/08/11 14:43:53.0977 VMBusHID (ec2bbab4b84d0738c6c83d2234dc36fe) C:\Windows\system32\DRIVERS\VMBusHID.sys
2010/08/11 14:43:54.0007 volmgr (384e5a2aa49934295171e499f86ba6f3) C:\Windows\system32\DRIVERS\volmgr.sys
2010/08/11 14:43:54.0030 volmgrx (b5bb72067ddddbbfb04b2f89ff8c3c87) C:\Windows\system32\drivers\volmgrx.sys
2010/08/11 14:43:54.0052 volsnap (58df9d2481a56edde167e51b334d44fd) C:\Windows\system32\DRIVERS\volsnap.sys
2010/08/11 14:43:54.0094 vsmraid (9dfa0cc2f8855a04816729651175b631) C:\Windows\system32\DRIVERS\vsmraid.sys
2010/08/11 14:43:54.0124 vwifibus (90567b1e658001e79d7c8bbd3dde5aa6) C:\Windows\System32\drivers\vwifibus.sys
2010/08/11 14:43:54.0155 WacomPen (de3721e89c653aa281428c8a69745d90) C:\Windows\system32\DRIVERS\wacompen.sys
2010/08/11 14:43:54.0191 WANARP (692a712062146e96d28ba0b7d75de31b) C:\Windows\system32\DRIVERS\wanarp.sys
2010/08/11 14:43:54.0201 Wanarpv6 (692a712062146e96d28ba0b7d75de31b) C:\Windows\system32\DRIVERS\wanarp.sys
2010/08/11 14:43:54.0243 Wd (1112a9badacb47b7c0bb0392e3158dff) C:\Windows\system32\DRIVERS\wd.sys
2010/08/11 14:43:54.0275 Wdf01000 (9950e3d0f08141c7e89e64456ae7dc73) C:\Windows\system32\drivers\Wdf01000.sys
2010/08/11 14:43:54.0326 WfpLwf (8b9a943f3b53861f2bfaf6c186168f79) C:\Windows\system32\DRIVERS\wfplwf.sys
2010/08/11 14:43:54.0350 WIMMount (5cf95b35e59e2a38023836fff31be64c) C:\Windows\system32\drivers\wimmount.sys
2010/08/11 14:43:54.0430 WinUsb (30fc6e5448d0cbaaa95280eeef7fedae) C:\Windows\system32\DRIVERS\WinUsb.sys
2010/08/11 14:43:54.0458 WmiAcpi (0217679b8fca58714c3bf2726d2ca84e) C:\Windows\system32\DRIVERS\wmiacpi.sys
2010/08/11 14:43:54.0508 ws2ifsl (6db3276587b853bf886b69528fdb048c) C:\Windows\system32\drivers\ws2ifsl.sys
2010/08/11 14:43:54.0541 WudfPf (6f9b6c0c93232cff47d0f72d6db1d21e) C:\Windows\system32\drivers\WudfPf.sys
2010/08/11 14:43:54.0581 WUDFRd (f91ff1e51fca30b3c3981db7d5924252) C:\Windows\system32\DRIVERS\WUDFRd.sys
2010/08/11 14:43:54.0663 ================================================================================
2010/08/11 14:43:54.0663 Scan finished
2010/08/11 14:43:54.0663 ================================================================================

Did it give you any message of disinfecting?

No, it did not give any message of disinfecting. The problem still persists and occasionally pop-ups of random websites might come up in my browser. The pop-ups overrides my Adblock Plus but the page is stopped from loading by NoScripts on Mozilla Firefox.

AdBlock Plus is more aimed at ads on a page, rather than popups. It does not guard against popup ads.

Let us look with another tool. If this tool crashes, uncheck Devices and try again.

=============

GMER

Note about this tool:

• This program may freeze. Do not reboot the computer, unless it has been frozen for over 30 minutes.
  
• This program may cause a blue screen of death. If it does, do not scan, and then reply to let me know.
  
• No matter what is in the log, please post all the information/contents of the log.
  
• These types of scans can produce false positives. Do NOT take any action on any "<--- ROOKIT"

Please download the GMER Rootkit Scanner. Unzip it to your Desktop.

Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

Double-click gmer.exe. The program will begin to run.

If possible rootkit activity is found, you will be asked if you would like to perform a full scan.

• Click NO
  
• In the right panel, you will see a bunch of boxes that have been checked ... leave everything checked and ensure the Show all box is un-checked.
  
• Now click the Scan button.
  Once the scan is complete, you may receive another notice about rootkit activity.
  
• Click OK.
  
• GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "GMER.txt"
  
• Save it where you can easily find it, such as your desktop.

Post the contents of GMER.txt in your next reply.

Okay, so here is the log from the GMER scan.

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-08-15 14:45:53
Windows 6.1.7600
Running: gmer.exe; Driver: C:\Users\Chan\AppData\Local\Temp\kxldqpog.sys


---- System - GMER 1.0.15 ----

INT 0x1F \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 83245AF8
INT 0x37 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 83245104
INT 0xC1 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 832453F4
INT 0xD1 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 8322E2D8
INT 0xD2 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 8322D898
INT 0xDF \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 832451DC
INT 0xE1 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 83245958
INT 0xE3 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 832456F8
INT 0xFD \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 83245F2C
INT 0xFE \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 832461A8

---- Kernel code sections - GMER 1.0.15 ----

.text ntkrnlpa.exe!ZwSaveKeyEx + 13AD 82E5E599 1 Byte [06]
.text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 82E82F52 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text C:\Windows\system32\DRIVERS\atikmdag.sys section is writeable [0x92222000, 0x2FBAB4, 0xE8000020]
.text C:\Windows\system32\DRIVERS\atksgt.sys section is writeable [0x9E68A300, 0x3B6D8, 0xE8000020]
.text C:\Windows\system32\DRIVERS\lirsgt.sys section is writeable [0x9E6DA300, 0x1BEE, 0xE8000020]
.text peauth.sys 9E6E4C9D 28 Bytes [D5, 0C, 6E, C2, C4, 9D, 9F, ...]
.text peauth.sys 9E6E4CC1 28 Bytes [D5, 0C, 6E, C2, C4, 9D, 9F, ...]
PAGE peauth.sys 9E6EAB9B 72 Bytes [C9, 2F, 50, FA, 01, 36, 34, ...]
PAGE peauth.sys 9E6EABEC 111 Bytes [19, 7B, 42, DD, 4C, 16, 29, ...]
PAGE peauth.sys 9E6EAE20 101 Bytes [0B, BC, FB, 00, A0, 72, 60, ...]
PAGE ...
.text autochk.exe 004411D1 16 Bytes [FA, FF, 75, 0F, 8B, 45, E0, ...]
.text autochk.exe 004411E4 131 Bytes [8B, 45, D4, 99, 89, 45, 8C, ...]
.text autochk.exe 00441268 1 Byte [6A]
.text autochk.exe 00441268 8 Bytes [6A, 00, 8B, 55, FC, 52, FF, ...]
.text autochk.exe 00441271 2 Bytes [70, 47] {JO 0x49}
.text ...
.text advapi32.dll!CreateServiceW 768ADBC1 6 Bytes JMP 71940F5A
.text advapi32.dll!CreateServiceA 768C2120 6 Bytes JMP 71970F5A
.text user32.dll!SendMessageA 7606CC28 6 Bytes JMP 71A30F5A
.text user32.dll!PostMessageA 7606D656 6 Bytes JMP 719D0F5A
.text user32.dll!PostMessageW 76076225 6 Bytes JMP 719A0F5A
.text user32.dll!SendMessageW 7607764C 6 Bytes JMP 71A00F5A
.text user32.dll!mouse_event 76088146 6 Bytes JMP 71AC0F5A
.text user32.dll!SendInput 76097055 3 Bytes [FF, 25, 1E]
.text user32.dll!SendInput + 4 76097059 2 Bytes [A5, 71]
.text user32.dll!keybd_event 760BEC9B 6 Bytes JMP 71A90F5A

---- User code sections - GMER 1.0.15 ----

.text C:\Windows\system32\svchost.exe[1004] ntdll.dll!NtProtectVirtualMemory 77A25360 5 Bytes JMP 0018000A
.text C:\Windows\system32\svchost.exe[1004] ntdll.dll!NtWriteVirtualMemory 77A25EE0 5 Bytes JMP 0019000A
.text C:\Windows\system32\svchost.exe[1004] ntdll.dll!KiUserExceptionDispatcher 77A26448 5 Bytes JMP 0017000A
.text C:\Windows\system32\svchost.exe[1004] ole32.dll!CoCreateInstance 761857FC 5 Bytes JMP 0038000A
.text C:\Windows\system32\svchost.exe[1004] USER32.dll!GetCursorPos 7606C198 5 Bytes JMP 00C5000A
.text C:\Program Files\Mozilla Firefox 4.0 Beta 2\firefox.exe[2016] ntdll.dll!NtCreateFile 77A24A10 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Mozilla Firefox 4.0 Beta 2\firefox.exe[2016] ntdll.dll!NtCreateFile + 4 77A24A14 2 Bytes [7E, 71] {JLE 0x73}
.text C:\Program Files\Mozilla Firefox 4.0 Beta 2\firefox.exe[2016] ntdll.dll!NtDeleteValueKey 77A24C90 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Mozilla Firefox 4.0 Beta 2\firefox.exe[2016] ntdll.dll!NtDeleteValueKey + 4 77A24C94 2 Bytes [84, 71]
.text C:\Program Files\Mozilla Firefox 4.0 Beta 2\firefox.exe[2016] ntdll.dll!NtOpenProcess 77A251D0 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Mozilla Firefox 4.0 Beta 2\firefox.exe[2016] ntdll.dll!NtOpenProcess + 4 77A251D4 2 Bytes [81, 71]
.text C:\Program Files\Mozilla Firefox 4.0 Beta 2\firefox.exe[2016] ntdll.dll!NtProtectVirtualMemory 77A25360 5 Bytes JMP 0028000A
.text C:\Program Files\Mozilla Firefox 4.0 Beta 2\firefox.exe[2016] ntdll.dll!NtSetValueKey 77A25C50 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Mozilla Firefox 4.0 Beta 2\firefox.exe[2016] ntdll.dll!NtSetValueKey + 4 77A25C54 2 Bytes [87, 71]
.text C:\Program Files\Mozilla Firefox 4.0 Beta 2\firefox.exe[2016] ntdll.dll!NtWriteVirtualMemory 77A25EE0 5 Bytes JMP 003E000A
.text C:\Program Files\Mozilla Firefox 4.0 Beta 2\firefox.exe[2016] ntdll.dll!KiUserExceptionDispatcher 77A26448 5 Bytes JMP 0027000A
.text C:\Program Files\Mozilla Firefox 4.0 Beta 2\firefox.exe[2016] ntdll.dll!LdrLoadDll 77A3F585 5 Bytes JMP 01161410 C:\Program Files\Mozilla Firefox 4.0 Beta 2\firefox.exe (Firefox/Mozilla Corporation)
.text C:\Program Files\Mozilla Firefox 4.0 Beta 2\firefox.exe[2016] ADVAPI32.dll!CreateServiceW 768ADBC1 6 Bytes JMP 718B0F5A
.text C:\Program Files\Mozilla Firefox 4.0 Beta 2\firefox.exe[2016] ADVAPI32.dll!CreateServiceA 768C2120 6 Bytes JMP 718E0F5A
.text C:\Program Files\Mozilla Firefox 4.0 Beta 2\firefox.exe[2016] WS2_32.dll!connect 775748BE 6 Bytes JMP 71AF0F5A
.text C:\Program Files\Mozilla Firefox 4.0 Beta 2\firefox.exe[2016] WS2_32.dll!WSALookupServiceBeginW 7757561A 6 Bytes JMP 71A60F5A
.text C:\Program Files\Mozilla Firefox 4.0 Beta 2\firefox.exe[2016] WS2_32.dll!listen 7757A6EA 6 Bytes JMP 71A90F5A
.text C:\Program Files\Mozilla Firefox 4.0 Beta 2\firefox.exe[2016] USER32.dll!SendMessageA 7606CC28 6 Bytes JMP 719A0F5A
.text C:\Program Files\Mozilla Firefox 4.0 Beta 2\firefox.exe[2016] USER32.dll!PostMessageA 7606D656 6 Bytes JMP 71940F5A
.text C:\Program Files\Mozilla Firefox 4.0 Beta 2\firefox.exe[2016] USER32.dll!PostMessageW 76076225 6 Bytes JMP 71910F5A
.text C:\Program Files\Mozilla Firefox 4.0 Beta 2\firefox.exe[2016] USER32.dll!SendMessageW 7607764C 6 Bytes JMP 71970F5A
.text C:\Program Files\Mozilla Firefox 4.0 Beta 2\firefox.exe[2016] USER32.dll!mouse_event 76088146 6 Bytes JMP 71A30F5A
.text C:\Program Files\Mozilla Firefox 4.0 Beta 2\firefox.exe[2016] USER32.dll!SendInput 76097055 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Mozilla Firefox 4.0 Beta 2\firefox.exe[2016] USER32.dll!SendInput + 4 76097059 2 Bytes [9C, 71]
.text C:\Program Files\Mozilla Firefox 4.0 Beta 2\firefox.exe[2016] USER32.dll!keybd_event 760BEC9B 6 Bytes JMP 71A00F5A
.text C:\Windows\system32\Dwm.exe[2528] ntdll.dll!NtCreateFile 77A24A10 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\Dwm.exe[2528] ntdll.dll!NtCreateFile + 4 77A24A14 2 Bytes [87, 71]
.text C:\Windows\system32\Dwm.exe[2528] ntdll.dll!NtDeleteValueKey 77A24C90 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\Dwm.exe[2528] ntdll.dll!NtDeleteValueKey + 4 77A24C94 2 Bytes [8D, 71]
.text C:\Windows\system32\Dwm.exe[2528] ntdll.dll!NtOpenProcess 77A251D0 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\Dwm.exe[2528] ntdll.dll!NtOpenProcess + 4 77A251D4 2 Bytes [8A, 71]
.text C:\Windows\system32\Dwm.exe[2528] ntdll.dll!NtSetValueKey 77A25C50 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\Dwm.exe[2528] ntdll.dll!NtSetValueKey + 4 77A25C54 2 Bytes [90, 71]
.text C:\Windows\system32\Dwm.exe[2528] USER32.dll!SendMessageA 7606CC28 6 Bytes JMP 71A30F5A
.text C:\Windows\system32\Dwm.exe[2528] USER32.dll!PostMessageA 7606D656 6 Bytes JMP 719D0F5A
.text C:\Windows\system32\Dwm.exe[2528] USER32.dll!PostMessageW 76076225 6 Bytes JMP 719A0F5A
.text C:\Windows\system32\Dwm.exe[2528] USER32.dll!SendMessageW 7607764C 6 Bytes JMP 71A00F5A
.text C:\Windows\system32\Dwm.exe[2528] USER32.dll!mouse_event 76088146 6 Bytes JMP 71AC0F5A
.text C:\Windows\system32\Dwm.exe[2528] USER32.dll!SendInput 76097055 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\Dwm.exe[2528] USER32.dll!SendInput + 4 76097059 2 Bytes [A5, 71]
.text C:\Windows\system32\Dwm.exe[2528] USER32.dll!keybd_event 760BEC9B 6 Bytes JMP 71A90F5A
.text C:\Windows\system32\Dwm.exe[2528] ADVAPI32.dll!CreateServiceW 768ADBC1 6 Bytes JMP 71940F5A
.text C:\Windows\system32\Dwm.exe[2528] ADVAPI32.dll!CreateServiceA 768C2120 6 Bytes JMP 71970F5A
.text C:\Windows\system32\taskhost.exe[2544] ntdll.dll!NtCreateFile 77A24A10 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\taskhost.exe[2544] ntdll.dll!NtCreateFile + 4 77A24A14 2 Bytes [87, 71]
.text C:\Windows\system32\taskhost.exe[2544] ntdll.dll!NtDeleteValueKey 77A24C90 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\taskhost.exe[2544] ntdll.dll!NtDeleteValueKey + 4 77A24C94 2 Bytes [8D, 71]
.text C:\Windows\system32\taskhost.exe[2544] ntdll.dll!NtOpenProcess 77A251D0 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\taskhost.exe[2544] ntdll.dll!NtOpenProcess + 4 77A251D4 2 Bytes [8A, 71]
.text C:\Windows\system32\taskhost.exe[2544] ntdll.dll!NtSetValueKey 77A25C50 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\taskhost.exe[2544] ntdll.dll!NtSetValueKey + 4 77A25C54 2 Bytes [90, 71]
.text C:\Windows\system32\taskhost.exe[2544] USER32.dll!SendMessageA 7606CC28 6 Bytes JMP 71A30F5A
.text C:\Windows\system32\taskhost.exe[2544] USER32.dll!PostMessageA 7606D656 6 Bytes JMP 719D0F5A
.text C:\Windows\system32\taskhost.exe[2544] USER32.dll!PostMessageW 76076225 6 Bytes JMP 719A0F5A
.text C:\Windows\system32\taskhost.exe[2544] USER32.dll!SendMessageW 7607764C 6 Bytes JMP 71A00F5A
.text C:\Windows\system32\taskhost.exe[2544] USER32.dll!mouse_event 76088146 6 Bytes JMP 71AC0F5A
.text C:\Windows\system32\taskhost.exe[2544] USER32.dll!SendInput 76097055 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\taskhost.exe[2544] USER32.dll!SendInput + 4 76097059 2 Bytes [A5, 71]
.text C:\Windows\system32\taskhost.exe[2544] USER32.dll!keybd_event 760BEC9B 6 Bytes JMP 71A90F5A
.text C:\Windows\system32\taskhost.exe[2544] ADVAPI32.dll!CreateServiceW 768ADBC1 6 Bytes JMP 71940F5A
.text C:\Windows\system32\taskhost.exe[2544] ADVAPI32.dll!CreateServiceA 768C2120 6 Bytes JMP 71970F5A
.text C:\Windows\Explorer.EXE[2624] ntdll.dll!NtCreateFile 77A24A10 3 Bytes [FF, 25, 1E]
.text C:\Windows\Explorer.EXE[2624] ntdll.dll!NtCreateFile + 4 77A24A14 2 Bytes [87, 71]
.text C:\Windows\Explorer.EXE[2624] ntdll.dll!NtDeleteValueKey 77A24C90 3 Bytes [FF, 25, 1E]
.text C:\Windows\Explorer.EXE[2624] ntdll.dll!NtDeleteValueKey + 4 77A24C94 2 Bytes [8D, 71]
.text C:\Windows\Explorer.EXE[2624] ntdll.dll!NtOpenProcess 77A251D0 3 Bytes [FF, 25, 1E]
.text C:\Windows\Explorer.EXE[2624] ntdll.dll!NtOpenProcess + 4 77A251D4 2 Bytes [8A, 71]
.text C:\Windows\Explorer.EXE[2624] ntdll.dll!NtProtectVirtualMemory 77A25360 5 Bytes JMP 002D000A
.text C:\Windows\Explorer.EXE[2624] ntdll.dll!NtSetValueKey 77A25C50 3 Bytes [FF, 25, 1E]
.text C:\Windows\Explorer.EXE[2624] ntdll.dll!NtSetValueKey + 4 77A25C54 2 Bytes [90, 71]
.text C:\Windows\Explorer.EXE[2624] ntdll.dll!NtWriteVirtualMemory 77A25EE0 5 Bytes JMP 002E000A
.text C:\Windows\Explorer.EXE[2624] ntdll.dll!KiUserExceptionDispatcher 77A26448 5 Bytes JMP 002C000A
.text C:\Windows\Explorer.EXE[2624] ADVAPI32.dll!CreateServiceW 768ADBC1 6 Bytes JMP 71940F5A
.text C:\Windows\Explorer.EXE[2624] ADVAPI32.dll!CreateServiceA 768C2120 6 Bytes JMP 71970F5A
.text C:\Windows\Explorer.EXE[2624] USER32.dll!SendMessageA 7606CC28 6 Bytes JMP 71A30F5A
.text C:\Windows\Explorer.EXE[2624] USER32.dll!PostMessageA 7606D656 6 Bytes JMP 719D0F5A
.text C:\Windows\Explorer.EXE[2624] USER32.dll!PostMessageW 76076225 6 Bytes JMP 719A0F5A
.text C:\Windows\Explorer.EXE[2624] USER32.dll!SendMessageW 7607764C 6 Bytes JMP 71A00F5A
.text C:\Windows\Explorer.EXE[2624] USER32.dll!mouse_event 76088146 6 Bytes JMP 71AC0F5A
.text C:\Windows\Explorer.EXE[2624] USER32.dll!SendInput 76097055 3 Bytes [FF, 25, 1E]
.text C:\Windows\Explorer.EXE[2624] USER32.dll!SendInput + 4 76097059 2 Bytes [A5, 71]
.text C:\Windows\Explorer.EXE[2624] USER32.dll!keybd_event 760BEC9B 6 Bytes JMP 71A90F5A
.text C:\Windows\Explorer.EXE[2624] WS2_32.dll!connect 775748BE 6 Bytes JMP 71820F5A
.text C:\Windows\Explorer.EXE[2624] WS2_32.dll!WSALookupServiceBeginW 7757561A 6 Bytes JMP 71850F5A
.text C:\Windows\Explorer.EXE[2624] WS2_32.dll!listen 7757A6EA 6 Bytes JMP 717F0F5A
.text C:\Users\Chan\Desktop\gmer.exe[2632] ntdll.dll!NtCreateFile 77A24A10 3 Bytes [FF, 25, 1E]
.text C:\Users\Chan\Desktop\gmer.exe[2632] ntdll.dll!NtCreateFile + 4 77A24A14 2 Bytes [87, 71]
.text C:\Users\Chan\Desktop\gmer.exe[2632] ntdll.dll!NtDeleteValueKey 77A24C90 3 Bytes [FF, 25, 1E]
.text C:\Users\Chan\Desktop\gmer.exe[2632] ntdll.dll!NtDeleteValueKey + 4 77A24C94 2 Bytes [8D, 71]
.text C:\Users\Chan\Desktop\gmer.exe[2632] ntdll.dll!NtOpenProcess 77A251D0 3 Bytes [FF, 25, 1E]
.text C:\Users\Chan\Desktop\gmer.exe[2632] ntdll.dll!NtOpenProcess + 4 77A251D4 2 Bytes [8A, 71]
.text C:\Users\Chan\Desktop\gmer.exe[2632] ntdll.dll!NtSetValueKey 77A25C50 3 Bytes [FF, 25, 1E]
.text C:\Users\Chan\Desktop\gmer.exe[2632] ntdll.dll!NtSetValueKey + 4 77A25C54 2 Bytes [90, 71]
.text C:\Users\Chan\Desktop\gmer.exe[2632] USER32.dll!SendMessageA 7606CC28 6 Bytes JMP 71A30F5A
.text C:\Users\Chan\Desktop\gmer.exe[2632] USER32.dll!PostMessageA 7606D656 6 Bytes JMP 719D0F5A
.text C:\Users\Chan\Desktop\gmer.exe[2632] USER32.dll!PostMessageW 76076225 6 Bytes JMP 719A0F5A
.text C:\Users\Chan\Desktop\gmer.exe[2632] USER32.dll!SendMessageW 7607764C 6 Bytes JMP 71A00F5A
.text C:\Users\Chan\Desktop\gmer.exe[2632] USER32.dll!mouse_event 76088146 6 Bytes JMP 71AC0F5A
.text C:\Users\Chan\Desktop\gmer.exe[2632] USER32.dll!SendInput 76097055 3 Bytes [FF, 25, 1E]
.text C:\Users\Chan\Desktop\gmer.exe[2632] USER32.dll!SendInput + 4 76097059 2 Bytes [A5, 71]
.text C:\Users\Chan\Desktop\gmer.exe[2632] USER32.dll!keybd_event 760BEC9B 6 Bytes JMP 71A90F5A
.text C:\Users\Chan\Desktop\gmer.exe[2632] ADVAPI32.dll!CreateServiceW 768ADBC1 6 Bytes JMP 71940F5A
.text C:\Users\Chan\Desktop\gmer.exe[2632] ADVAPI32.dll!CreateServiceA 768C2120 6 Bytes JMP 71970F5A
.text C:\Program Files\Alwil Software\Avast4\ashDisp.exe[2832] ntdll.dll!NtCreateFile 77A24A10 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Alwil Software\Avast4\ashDisp.exe[2832] ntdll.dll!NtCreateFile + 4 77A24A14 2 Bytes [7E, 71] {JLE 0x73}
.text C:\Program Files\Alwil Software\Avast4\ashDisp.exe[2832] ntdll.dll!NtDeleteValueKey 77A24C90 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Alwil Software\Avast4\ashDisp.exe[2832] ntdll.dll!NtDeleteValueKey + 4 77A24C94 2 Bytes [84, 71]
.text C:\Program Files\Alwil Software\Avast4\ashDisp.exe[2832] ntdll.dll!NtOpenProcess 77A251D0 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Alwil Software\Avast4\ashDisp.exe[2832] ntdll.dll!NtOpenProcess + 4 77A251D4 2 Bytes [81, 71]
.text C:\Program Files\Alwil Software\Avast4\ashDisp.exe[2832] ntdll.dll!NtSetValueKey 77A25C50 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Alwil Software\Avast4\ashDisp.exe[2832] ntdll.dll!NtSetValueKey + 4 77A25C54 2 Bytes [87, 71]
.text C:\Program Files\Alwil Software\Avast4\ashDisp.exe[2832] USER32.dll!SendMessageA 7606CC28 6 Bytes JMP 719A0F5A
.text C:\Program Files\Alwil Software\Avast4\ashDisp.exe[2832] USER32.dll!PostMessageA 7606D656 6 Bytes JMP 71940F5A
.text C:\Program Files\Alwil Software\Avast4\ashDisp.exe[2832] USER32.dll!PostMessageW 76076225 6 Bytes JMP 71910F5A
.text C:\Program Files\Alwil Software\Avast4\ashDisp.exe[2832] USER32.dll!SendMessageW 7607764C 6 Bytes JMP 71970F5A
.text C:\Program Files\Alwil Software\Avast4\ashDisp.exe[2832] USER32.dll!mouse_event 76088146 6 Bytes JMP 71A30F5A
.text C:\Program Files\Alwil Software\Avast4\ashDisp.exe[2832] USER32.dll!SendInput 76097055 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Alwil Software\Avast4\ashDisp.exe[2832] USER32.dll!SendInput + 4 76097059 2 Bytes [9C, 71]
.text C:\Program Files\Alwil Software\Avast4\ashDisp.exe[2832] USER32.dll!keybd_event 760BEC9B 6 Bytes JMP 71A00F5A
.text C:\Program Files\Alwil Software\Avast4\ashDisp.exe[2832] ADVAPI32.dll!CreateServiceW 768ADBC1 6 Bytes JMP 718B0F5A
.text C:\Program Files\Alwil Software\Avast4\ashDisp.exe[2832] ADVAPI32.dll!CreateServiceA 768C2120 6 Bytes JMP 718E0F5A
.text C:\Program Files\Alwil Software\Avast4\ashDisp.exe[2832] WS2_32.dll!connect 775748BE 6 Bytes JMP 71AF0F5A
.text C:\Program Files\Alwil Software\Avast4\ashDisp.exe[2832] WS2_32.dll!WSALookupServiceBeginW 7757561A 6 Bytes JMP 71A60F5A
.text C:\Program Files\Alwil Software\Avast4\ashDisp.exe[2832] WS2_32.dll!listen 7757A6EA 6 Bytes JMP 71A90F5A
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2840] ntdll.dll!NtCreateFile 77A24A10 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2840] ntdll.dll!NtCreateFile + 4 77A24A14 2 Bytes [87, 71]
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2840] ntdll.dll!NtDeleteValueKey 77A24C90 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2840] ntdll.dll!NtDeleteValueKey + 4 77A24C94 2 Bytes [8D, 71]
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2840] ntdll.dll!NtOpenProcess 77A251D0 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2840] ntdll.dll!NtOpenProcess + 4 77A251D4 2 Bytes [8A, 71]
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2840] ntdll.dll!NtSetValueKey 77A25C50 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2840] ntdll.dll!NtSetValueKey + 4 77A25C54 2 Bytes [90, 71]
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2840] ADVAPI32.dll!CreateServiceW 768ADBC1 6 Bytes JMP 71940F5A
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2840] ADVAPI32.dll!CreateServiceA 768C2120 6 Bytes JMP 71970F5A
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2840] USER32.dll!SendMessageA 7606CC28 6 Bytes JMP 71A30F5A
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2840] USER32.dll!PostMessageA 7606D656 6 Bytes JMP 719D0F5A
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2840] USER32.dll!PostMessageW 76076225 6 Bytes JMP 719A0F5A
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2840] USER32.dll!SendMessageW 7607764C 6 Bytes JMP 71A00F5A
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2840] USER32.dll!mouse_event 76088146 6 Bytes JMP 71AC0F5A
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2840] USER32.dll!SendInput 76097055 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2840] USER32.dll!SendInput + 4 76097059 2 Bytes [A5, 71]
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2840] USER32.dll!keybd_event 760BEC9B 6 Bytes JMP 71A90F5A

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\Program Files\Emsisoft Anti-Malware\a2service.exe[1792] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!CreateThread] [004554DC] C:\Program Files\Emsisoft Anti-Malware\a2service.exe (Emsisoft Anti-Malware Service/Emsi Software GmbH)
IAT C:\Program Files\Emsisoft Anti-Malware\a2service.exe[1792] @ C:\Windows\system32\shell32.dll [KERNEL32.dll!QueueUserWorkItem] [004556E0] C:\Program Files\Emsisoft Anti-Malware\a2service.exe (Emsisoft Anti-Malware Service/Emsi Software GmbH)
IAT C:\Program Files\Emsisoft Anti-Malware\a2service.exe[1792] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!CreateThread] [004554DC] C:\Program Files\Emsisoft Anti-Malware\a2service.exe (Emsisoft Anti-Malware Service/Emsi Software GmbH)
IAT C:\Program Files\Emsisoft Anti-Malware\a2service.exe[1792] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!QueueUserWorkItem] [004556E0] C:\Program Files\Emsisoft Anti-Malware\a2service.exe (Emsisoft Anti-Malware Service/Emsi Software GmbH)
IAT C:\Program Files\Emsisoft Anti-Malware\a2service.exe[1792] @ C:\Windows\system32\WININET.dll [KERNEL32.dll!CreateThread] [004554DC] C:\Program Files\Emsisoft Anti-Malware\a2service.exe (Emsisoft Anti-Malware Service/Emsi Software GmbH)

---- Devices - GMER 1.0.15 ----

AttachedDevice \Driver\tdx \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

Device \Driver\ACPI_HAL \Device\0000005a halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)

AttachedDevice \Driver\tdx \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\tdx \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xD4 0xC3 0x97 0x02 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x68 0x38 0x9A 0xDC ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x3D 0x39 0x24 0x38 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x9D 0xB7 0x99 0x37 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1@hdf12 0x67 0x95 0x26 0xE6 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xD4 0xC3 0x97 0x02 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x68 0x38 0x9A 0xDC ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x3D 0x39 0x24 0x38 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x9D 0xB7 0x99 0x37 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1@hdf12 0x67 0x95 0x26 0xE6 ...

---- EOF - GMER 1.0.15 ----

VirSCAN.org Scanned Report :
Scanned time : 2010/08/16 19:29:03 (PDT)
Scanner results: Scanners did not find malware!
File Name : explorer.exe
File Size : 2614272 byte
File Type : PE32 executable for MS Windows (GUI) Intel 80386 32-bit
MD5 : 2626fc9755be22f805d3cfa0ce3ee727
SHA1 : d76db4dcd710be9c3314cff94824933847565372
Online report : http://virscan.org/report/746da46a01adfeb09284d12eec4d9775.html

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 5.0.0.18 20100817050930 2010-08-17 40.09 -
AhnLab V3 2010.08.07.00 2010.08.07 2010-08-07 40.14 -
AntiVir 8.2.4.34 7.10.10.201 2010-08-16 0.27 -
Antiy 2.0.18 20100815.4936744 2010-08-15 0.02 -
Arcavir 2009 201006281601 2010-06-28 0.00 -
Authentium 5.1.1 201008162205 2010-08-16 2.84 -
AVAST! 4.7.4 100816-2 2010-08-16 0.12 -
AVG 8.5.793 271.1.1/3076 2010-08-17 0.26 -
BitDefender 7.90123.6151351 7.33396 2010-08-17 4.48 -
ClamAV 0.96.1 11567 2010-08-17 0.72 -
Comodo 4.0 5765 2010-08-16 40.09 -
CP Secure 1.3.0.5 2010.08.17 2010-08-17 0.51 -
Dr.Web 5.0.2.3300 2010.08.17 2010-08-17 9.32 -
F-Prot 4.4.4.56 20100816 2010-08-16 2.94 -
F-Secure 7.02.73807 2010.08.16.10 2010-08-16 15.72 -
Fortinet 4.1.143 12.254 2010-08-16 40.09 -
GData 21.682/21.263 20100816 2010-08-16 40.09 -
ViRobot 20100816 2010.08.16 2010-08-16 40.15 -
Ikarus T3. 2010.08.17.76524 2010-08-17 5.24 -
JiangMin 13.0.900 2010.08.16 2010-08-16 40.09 -
Kaspersky 5.5.10 2010.08.16 2010-08-16 0.09 -
KingSoft 2009.2.5.15 2010.8.17.9 2010-08-17 40.09 -
McAfee 5400.1158 6076 2010-08-16 18.48 -
Microsoft 1.6004 2010.08.17 2010-08-17 40.18 -
Norman 6.05.11 6.05.00 2010-08-16 6.02 -
Panda 9.05.01 2010.08.16 2010-08-16 40.09 -
Trend Micro 9.120-1004 7.388.18 2010-08-16 0.03 -
Quick Heal 11.00 2010.08.16 2010-08-16 40.09 -
Rising 20.0 22.61.00.04 2010-08-16 40.27 -
Sophos 3.10.0 4.56 2010-08-17 5.96 -
Sunbelt 3.9.2432.2 6743 2010-08-16 40.19 -
Symantec 1.3.0.24 20100816.016 2010-08-16 0.29 -
nProtect 20100816.02 8811137 2010-08-16 40.09 -
The Hacker 6.5.2.1 v00349 2010-08-16 40.09 -
VBA32 3.12.14.0 20100813.0808 2010-08-13 4.81 -
VirusBuster 4.5.11.10 10.127.58/2036425 2010-08-17 3.56 -

Please download ComboFix from BleepingComputer.com

Alternate link: GeeksToGo.com

Alternate link: Forospyware.com (Click the green button on the page to download it).

Rename ComboFix.exe to combo-fix.exe before you save it to your Desktop

• Close any open browsers.
  
• Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  
• Open notepad and copy/paste the text in the quotebox below into it:
  

  killall::
  
  TDL::
  c:\windows\system32\drivers\atapi.sys
  
  Reboot::

• Save this as CFScript.txt, in the same location as ComboFix.exe
  
  
  
  
• Referring to the picture above, drag CFScript into ComboFix.exe
  
• When finished, it shall produce a log for you at C:\ComboFix.txt
  
• Please post the contents of the log in your next reply.

NOTE: [list][*]As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. It will probably not install on your machine.

ComboFix 10-08-16.03 - Chan 08/17/2010 1:05.3.4 - x86
Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.3326.2397 [GMT -7:00]
Running from: c:\users\Chan\Desktop\New folder\ComboFix.exe
Command switches used :: c:\users\Chan\Desktop\New folder\CFScript.txt.txt
SP: Spybot - Search and Destroy *disabled* (Updated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2010-07-17 to 2010-08-17 )))))))))))))))))))))))))))))))
.

2010-08-17 09:36 . 2009-07-14 01:26 21584 ----a-w- c:\windows\system32\drivers\atapi.sys
2010-08-17 08:15 . 2010-08-17 08:39 -------- d-----w- c:\users\Chan\AppData\Local\temp
2010-08-17 08:15 . 2010-08-17 08:15 -------- d-----w- c:\users\Public\AppData\Local\temp
2010-08-17 08:15 . 2010-08-17 08:15 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-08-17 08:03 . 2010-08-17 08:03 -------- d-----w- C:\Device
2010-08-16 10:15 . 2010-08-16 10:15 8432064 ----a-w- c:\users\Chan\AppData\Roaming\Azureus\tmp\AZU6186427272018498426.tmp\Vuze_4.5.0.2a_win32.exe
2010-08-11 22:43 . 2010-08-16 02:38 -------- d-----w- c:\users\Chan\AppData\Roaming\vlc
2010-08-11 07:21 . 2010-08-13 20:49 -------- d-----w- c:\program files\Emsisoft Anti-Malware
2010-08-11 06:54 . 2010-08-11 06:54 -------- d-----w- c:\program files\Sun
2010-08-11 06:36 . 2010-08-11 06:36 -------- d-----w- c:\windows\system32\MustBeRandomlyNamed
2010-08-10 06:30 . 2010-08-10 06:30 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
2010-08-09 02:33 . 2010-08-09 02:33 -------- d-----w- c:\users\Chan\AppData\Local\GamersFirst LIVE!
2010-08-09 02:33 . 2010-08-10 06:56 -------- d-----w- c:\users\Chan\AppData\Local\PMB Files
2010-08-09 02:33 . 2010-08-10 06:22 -------- d-----w- c:\programdata\PMB Files
2010-08-09 02:18 . 2010-08-09 02:33 -------- d-----w- c:\program files\GamersFirst
2010-08-04 22:24 . 2010-08-04 22:29 -------- d-----w- c:\program files\Disable Spyware
2010-08-04 20:29 . 2010-08-11 08:17 -------- d-----w- c:\program files\Warcraft III
2010-08-04 20:18 . 2010-08-04 20:18 -------- d-----w- c:\program files\Microsoft.NET
2010-08-04 18:57 . 2010-08-04 18:57 188152 ----a-w- c:\users\Chan\AppData\Roaming\Mozilla\Firefox\Profiles\s04jin69.default\FlashGot.exe
2010-08-04 18:54 . 2010-08-04 18:54 0 ----a-w- c:\windows\nsreg.dat
2010-08-04 18:53 . 2010-08-15 01:05 -------- d-----w- c:\program files\Mozilla Firefox 4.0 Beta 2
2010-08-01 03:06 . 2010-08-01 03:06 -------- d-----w- c:\program files\Paradox Interactive
2010-08-01 02:52 . 2010-08-10 07:51 -------- d-----w- c:\program files\StarCraft II
2010-07-29 22:39 . 2010-07-29 22:39 -------- d-----w- c:\program files\Common Files\Software Update Utility
2010-07-29 22:09 . 2009-11-24 22:48 23120 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-07-29 22:09 . 2009-11-24 22:49 48560 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-07-29 22:09 . 2009-11-24 22:47 97480 ----a-w- c:\windows\system32\AvastSS.scr
2010-07-29 22:09 . 2009-11-24 22:50 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-07-29 22:09 . 2009-11-24 22:50 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-07-29 22:08 . 2009-11-24 22:54 1280480 ----a-w- c:\windows\system32\aswBoot.exe
2010-07-29 22:08 . 2009-11-24 22:49 53328 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2010-07-29 22:08 . 2003-03-18 20:20 1060864 ----a-w- c:\windows\system32\MFC71.dll
2010-07-29 22:08 . 2010-07-29 22:08 -------- d-----w- c:\program files\Alwil Software
2010-07-29 08:43 . 2010-07-29 08:43 -------- d-----w- c:\program files\DAEMON Tools Toolbar
2010-07-29 07:36 . 2010-08-08 18:32 -------- d-----w- c:\users\Chan\AppData\Local\PokerStars
2010-07-29 07:36 . 2010-07-31 00:17 -------- d-----w- c:\program files\PokerStars
2010-07-29 05:55 . 2010-07-31 02:20 -------- d-----w- c:\users\Chan\AppData\Local\Adobe
2010-07-29 01:02 . 2010-07-29 22:40 -------- d-----w- c:\users\Chan\AppData\Local\AIM
2010-07-29 01:02 . 2010-07-29 01:02 -------- d-----w- c:\users\Chan\AppData\Local\AOL
2010-07-29 00:48 . 2010-07-29 00:48 47364 ----a-w- c:\programdata\Blizzard Entertainment\Battle.net\Cache\Download\Scan.dll
2010-07-29 00:04 . 2010-07-29 00:04 -------- d-----w- c:\program files\Common Files\Java
2010-07-29 00:04 . 2010-07-29 00:25 423656 ----a-w- c:\windows\system32\deployJava1.dll
2010-07-27 08:17 . 2010-01-11 02:40 118784 ----a-w- c:\windows\system32\MSSTDFMT.DLL
2010-07-27 08:11 . 2010-08-10 07:46 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2010-07-27 08:11 . 2010-07-27 08:20 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-07-22 22:56 . 2010-07-22 23:03 -------- d-----w- c:\program files\GameKiss
2010-07-21 22:06 . 2010-07-21 22:06 -------- d-----w- c:\program files\MegaDev
2010-07-21 10:10 . 2010-07-21 10:10 -------- d-----w- c:\programdata\Big Fish Games
2010-07-20 17:49 . 2010-07-20 17:49 -------- d-----w- c:\windows\Sun
2010-07-20 17:48 . 2010-08-02 04:06 -------- d-----w- c:\users\Chan\AppData\Roaming\Tropico 3
2010-07-20 17:35 . 2010-08-04 20:59 -------- d-----w- c:\program files\Kalypso
2010-07-19 17:25 . 2010-07-19 17:25 -------- d-----w- c:\users\Chan\AppData\Local\Ironclad Games
2010-07-19 17:25 . 2010-07-19 17:25 -------- d-----w- c:\programdata\Ironclad Games
2010-07-19 14:38 . 2010-07-19 15:16 -------- d-----w- c:\program files\Dragon Age
2010-07-19 07:24 . 2010-07-19 07:25 16820376 ----a-w- c:\programdata\Muzzy Lane\Client Installers\MakingHistoryIISetup-1.0.11.11972.exe
2010-07-19 07:09 . 2010-07-19 07:09 -------- d-----w- c:\users\Chan\AppData\Roaming\PE Explorer

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-16 10:24 . 2010-01-10 13:35 -------- d-----w- c:\users\Chan\AppData\Roaming\Azureus
2010-08-14 16:18 . 2010-02-22 11:28 -------- d-----w- c:\program files\Heroes of Newerth
2010-08-13 23:19 . 2010-04-04 23:20 -------- d-----w- c:\program files\Steam
2010-08-11 22:47 . 2010-04-04 23:20 -------- d-----w- c:\program files\Common Files\Steam
2010-08-11 09:15 . 2010-07-07 08:47 -------- d-----w- c:\program files\StarCraft Brood War by Monikon
2010-08-11 06:52 . 2010-01-10 13:42 -------- d-----w- c:\program files\Java
2010-08-09 02:33 . 2010-05-28 03:25 -------- d-----w- c:\program files\Pando Networks
2010-08-08 18:31 . 2010-02-03 01:04 -------- d-----w- c:\program files\Common Files\Blizzard Entertainment
2010-08-04 21:00 . 2010-05-30 03:05 -------- d-----w- c:\program files\Veetle
2010-08-04 19:15 . 2010-01-09 20:02 -------- d-----w- c:\program files\World of Warcraft
2010-08-01 03:02 . 2010-03-03 09:28 -------- d-----w- c:\programdata\Blizzard Entertainment
2010-07-31 07:06 . 2010-01-10 13:50 1 ----a-w- c:\users\Chan\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-07-31 01:38 . 2010-03-06 05:25 0 ----a-w- c:\users\Chan\AppData\Local\prvlcl.dat
2010-07-29 22:39 . 2010-01-10 12:20 -------- d-----w- c:\program files\AIM
2010-07-29 08:43 . 2010-03-10 01:51 -------- d-----w- c:\program files\DAEMON Tools Lite
2010-07-29 08:41 . 2010-03-10 01:51 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-07-29 01:01 . 2010-03-03 09:28 -------- d-----w- c:\program files\StarCraft II Beta
2010-07-28 23:44 . 2010-03-03 02:00 -------- d-----w- c:\program files\Opera
2010-07-28 23:36 . 2010-07-09 11:27 -------- d-----w- c:\program files\Mozilla Firefox 4.0 Beta 1
2010-07-27 08:27 . 2010-07-12 06:03 -------- d-----w- c:\program files\CCleaner
2010-07-22 23:03 . 2010-01-10 11:07 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-07-20 15:01 . 2010-01-10 20:47 -------- d-----w- c:\programdata\avg9
2010-07-20 03:54 . 2010-01-10 11:10 -------- d-----w- c:\program files\AGEIA Technologies
2010-07-20 03:53 . 2010-01-10 11:10 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-07-20 03:44 . 2010-07-15 10:21 -------- d-----w- c:\program files\Activision
2010-07-19 15:24 . 2010-05-01 23:25 -------- d-----w- c:\programdata\BioWare
2010-07-19 14:55 . 2010-04-06 08:58 -------- d-----w- c:\programdata\Media Center Programs
2010-07-19 14:55 . 2010-05-01 22:55 -------- d-----w- c:\program files\Common Files\BioWare
2010-07-17 23:14 . 2010-07-08 20:27 -------- d-----w- c:\programdata\Muzzy Lane
2010-07-17 23:13 . 2010-07-17 23:12 16820360 ----a-w- c:\programdata\Muzzy Lane\Client Installers\MakingHistoryIISetup-1.0.10.11963.exe
2010-07-17 19:19 . 2010-07-17 18:30 -------- d-----w- c:\program files\Empire Total War
2010-07-17 13:41 . 2010-07-17 13:41 56440 ----a-w- c:\programdata\Sony Ericsson\SEMC OMSI Module\omsiconf\org.eclipse.osgi\bundles\74\1\.cp\lib\sef3x1Controller.dll
2010-07-17 13:34 . 2010-07-17 13:34 1772664 ----a-w- c:\programdata\Sony Ericsson\SEMC OMSI Module\omsiconf\org.eclipse.osgi\bundles\41\1\.cp\lib\BHQ.dll
2010-07-17 13:34 . 2010-07-17 13:34 105592 ----a-w- c:\programdata\Sony Ericsson\SEMC OMSI Module\omsiconf\org.eclipse.osgi\bundles\41\1\.cp\lib\BHQFlash.dll
2010-07-17 13:34 . 2010-07-17 13:34 81016 ----a-w- c:\programdata\Sony Ericsson\SEMC OMSI Module\omsiconf\org.eclipse.osgi\bundles\70\1\.cp\lib\S1SLEngineWrapper.dll
2010-07-17 13:34 . 2010-07-17 13:34 105592 ----a-w- c:\programdata\Sony Ericsson\SEMC OMSI Module\omsiconf\org.eclipse.osgi\bundles\60\1\.cp\lib\MemStickFlash.dll
2010-07-17 13:33 . 2010-07-17 13:33 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_ggsemc_01007.Wdf
2010-07-17 13:33 . 2010-07-17 13:33 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_ggflt_01007.Wdf
2010-07-17 13:33 . 2010-07-17 13:33 101496 ----a-w- c:\programdata\Sony Ericsson\SEMC OMSI Module\omsiconf\org.eclipse.osgi\bundles\82\1\.cp\lib\USBFlash.dll
2010-07-17 13:30 . 2010-07-17 13:30 109752 ----a-w- c:\programdata\Sony Ericsson\SEMC OMSI Module\omsiconf\org.eclipse.osgi\bundles\66\1\.cp\lib\osds.dll
2010-07-17 13:30 . 2010-07-17 13:30 89208 ----a-w- c:\programdata\Sony Ericsson\SEMC OMSI Module\omsiconf\org.eclipse.osgi\bundles\80\1\.cp\lib\UAC.dll
2010-07-17 13:30 . 2010-07-17 13:30 57344 ----a-w- c:\programdata\Sony Ericsson\SEMC OMSI Module\omsiconf\org.eclipse.osgi\bundles\4\1\.cp\lib\serialio.dll
2010-07-17 13:30 . 2010-07-17 13:30 323648 ----a-w- c:\programdata\Sony Ericsson\SEMC OMSI Module\omsiconf\org.eclipse.osgi\bundles\10\1\.cp\lib\win32\DIFxAPI.dll
2010-07-17 13:30 . 2010-07-17 13:30 216184 ----a-w- c:\programdata\Sony Ericsson\SEMC OMSI Module\omsiconf\org.eclipse.osgi\bundles\68\1\.cp\lib\RegistryReader.dll
2010-07-17 13:30 . 2010-07-17 13:30 158840 ----a-w- c:\programdata\Sony Ericsson\SEMC OMSI Module\omsiconf\org.eclipse.osgi\bundles\10\1\.cp\lib\win32\DriverInstaller.exe
2010-07-17 13:30 . 2010-07-17 13:30 154744 ----a-w- c:\programdata\Sony Ericsson\SEMC OMSI Module\omsiconf\org.eclipse.osgi\bundles\8\1\.cp\lib\win32\DeviceRemover.exe
2010-07-17 13:30 . 2010-07-17 13:30 117880 ----a-w- c:\programdata\Sony Ericsson\SEMC OMSI Module\omsiconf\org.eclipse.osgi\bundles\6\1\.cp\lib\DeviceManager.dll
2010-07-17 13:28 . 2010-07-17 13:28 -------- d-----w- c:\program files\Common Files\Sony Ericsson
2010-07-17 13:28 . 2010-07-17 13:18 -------- d-----w- c:\program files\Sony Ericsson
2010-07-17 13:28 . 2010-07-17 13:18 -------- d-----w- c:\programdata\Sony Ericsson
2010-07-17 13:20 . 2010-07-17 13:20 -------- d-----w- c:\programdata\BVRP Software
2010-07-15 15:09 . 2010-01-10 20:48 243024 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2010-07-15 15:09 . 2010-07-15 15:09 12536 ----a-w- c:\windows\system32\avgrsstx.dll
2010-07-15 15:09 . 2010-01-10 20:48 216400 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2010-07-15 02:11 . 2010-07-15 02:11 -------- d-----w- c:\program files\MSXML 4.0
2010-07-14 20:17 . 2010-04-23 07:47 -------- d-----w- c:\program files\Mount&Blade Warband
2010-07-13 12:37 . 2010-04-08 10:05 -------- d-----w- c:\program files\Electronic Arts
2010-07-13 12:34 . 2010-05-10 22:24 -------- d-----w- c:\program files\LucasArts
2010-07-13 12:26 . 2010-02-06 09:19 -------- d-----w- c:\program files\Free Window Registry Repair
2010-07-13 11:29 . 2010-01-10 11:11 -------- d-----w- c:\programdata\NVIDIA
2010-07-13 03:48 . 2010-01-10 11:40 72064 ----a-w- c:\users\Chan\AppData\Local\GDIPFONTCACHEV1.DAT
2010-07-12 23:19 . 2009-07-14 04:52 -------- d-----w- c:\program files\Microsoft Games
2010-07-12 23:18 . 2010-01-10 11:08 -------- d-----w- c:\program files\Common Files\InstallShield
2010-07-12 10:20 . 2010-07-12 10:20 65536 ----a-r- c:\users\Chan\AppData\Roaming\Microsoft\Installer\{64893225-ADBA-469E-B114-F3B2C1FBBA77}\NewShortcut7_64893225ADBA469EB114F3B2C1FBBA77.exe
2010-07-12 10:20 . 2010-07-12 10:20 65536 ----a-r- c:\users\Chan\AppData\Roaming\Microsoft\Installer\{64893225-ADBA-469E-B114-F3B2C1FBBA77}\NewShortcut4_64893225ADBA469EB114F3B2C1FBBA77.exe
2010-07-12 10:20 . 2010-07-12 10:20 65536 ----a-r- c:\users\Chan\AppData\Roaming\Microsoft\Installer\{64893225-ADBA-469E-B114-F3B2C1FBBA77}\Manual_UK_64893225ADBA469EB114F3B2C1FBBA77.exe
2010-07-12 10:20 . 2010-07-12 10:20 65536 ----a-r- c:\users\Chan\AppData\Roaming\Microsoft\Installer\{64893225-ADBA-469E-B114-F3B2C1FBBA77}\Manual_FR_64893225ADBA469EB114F3B2C1FBBA77.exe
2010-07-12 10:20 . 2010-07-12 10:20 65536 ----a-r- c:\users\Chan\AppData\Roaming\Microsoft\Installer\{64893225-ADBA-469E-B114-F3B2C1FBBA77}\Manual_DE_64893225ADBA469EB114F3B2C1FBBA77.exe
2010-07-12 10:20 . 2010-07-12 10:20 45056 ----a-r- c:\users\Chan\AppData\Roaming\Microsoft\Installer\{64893225-ADBA-469E-B114-F3B2C1FBBA77}\S11Launcher.exeE_64893225ADBA469EB114F3B2C1FBBA77.exe
2010-07-12 10:20 . 2010-07-12 10:20 45056 ----a-r- c:\users\Chan\AppData\Roaming\Microsoft\Installer\{64893225-ADBA-469E-B114-F3B2C1FBBA77}\S11Launcher.exe_64893225ADBA469EB114F3B2C1FBBA77.exe
2010-07-12 10:19 . 2010-07-12 10:19 -------- d-----w- c:\program files\Koei
2010-07-12 06:04 . 2010-01-10 20:28 -------- d-----w- c:\users\Chan\AppData\Roaming\Media Player Classic
2010-07-12 06:03 . 2010-07-12 06:03 -------- d-----w- c:\program files\Defraggler
2010-07-09 08:58 . 2010-01-22 10:37 -------- d-----w- c:\program files\Microsoft Silverlight
2010-07-08 20:36 . 2010-07-08 20:35 16695072 ----a-w- c:\programdata\Muzzy Lane\Client Installers\MakingHistoryIISetup-1.0.9.exe
2010-07-08 20:29 . 2010-03-10 06:34 -------- d-----w- c:\program files\Muzzy Lane Software
2010-06-25 10:12 . 2010-06-25 10:12 -------- d-----w- c:\users\Chan\AppData\Roaming\LolClient
2010-06-25 03:08 . 2010-06-25 03:05 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-06-22 05:16 . 2010-05-14 02:17 -------- d-----w- c:\programdata\Electronic Arts
2010-06-22 05:15 . 2010-05-17 12:38 -------- d-----w- c:\program files\Graboid
2010-06-22 04:51 . 2010-06-22 04:51 -------- d-----w- c:\programdata\ATI
2010-06-22 04:51 . 2010-04-29 01:04 -------- d-----w- c:\program files\ATI Technologies
2010-06-22 01:46 . 2010-06-22 01:46 -------- d-----w- c:\program files\MPC HomeCinema
2010-06-02 16:35 . 2010-01-10 20:48 29584 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2010-05-28 04:04 . 2010-05-28 04:04 98304 ----a-w- c:\programdata\NexonUS\NGM\npNxGameUS.dll
2010-05-28 04:04 . 2010-05-28 04:04 765952 ----a-w- c:\programdata\NexonUS\NGM\NGMDll.dll
2010-05-28 04:04 . 2010-05-28 04:04 401408 ----a-w- c:\programdata\NexonUS\NGM\NGMResource.dll
2010-05-28 04:04 . 2010-05-28 04:04 258352 ----a-w- c:\programdata\NexonUS\NGM\unicows.dll
2010-05-28 04:04 . 2010-05-28 04:04 172032 ----a-w- c:\programdata\NexonUS\NGM\NGM.exe
2010-05-28 04:04 . 2010-05-28 04:04 126976 ----a-w- c:\programdata\NexonUS\NGM\nxgameus.dll
2010-05-27 17:38 . 2010-05-27 17:38 5586432 ----a-w- c:\windows\system32\drivers\atikmdag.sys
2010-05-27 17:05 . 2010-05-27 17:05 15180800 ----a-w- c:\windows\system32\atioglxx.dll
2010-05-27 17:02 . 2010-05-27 17:02 143360 ----a-w- c:\windows\system32\atiapfxx.exe
2010-05-27 17:02 . 2010-04-07 02:16 511488 ----a-w- c:\windows\system32\aticfx32.dll
2010-05-27 17:00 . 2010-05-27 17:00 446464 ----a-w- c:\windows\system32\ATIDEMGX.dll
2010-05-27 16:59 . 2010-05-27 16:59 376832 ----a-w- c:\windows\system32\atieclxx.exe
2010-05-27 16:59 . 2010-05-27 16:59 176128 ----a-w- c:\windows\system32\atiesrxx.exe
2010-05-27 16:58 . 2010-05-27 16:58 159744 ----a-w- c:\windows\system32\atitmmxx.dll
2010-05-27 16:58 . 2010-05-27 16:58 356352 ----a-w- c:\windows\system32\atipdlxx.dll
2010-05-27 16:58 . 2010-05-27 16:58 278528 ----a-w- c:\windows\system32\Oemdspif.dll
2009-06-10 21:26 . 2009-07-14 02:04 9633792 --sha-r- c:\windows\Fonts\StaticCache.dat
2009-07-14 01:14 . 2009-07-13 23:42 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2009-07-20 20:28 72208 ----a-w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sr.sys]
@="FSFilter System Recovery"

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^GamersFirst LIVE!.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\GamersFirst LIVE!.lnk
backup=c:\windows\pss\GamersFirst LIVE!.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Logitech SetPoint.lnk]
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^Users^Chan^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Logitech . Product Registration.lnk]
backup=c:\windows\pss\Logitech . Product Registration.lnk.Startup
backupExtension=.Startup

[HKLM\~\startupfolder\C:^Users^Chan^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.1.lnk]
backup=c:\windows\pss\OpenOffice.org 3.1.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-06-09 08:06 976832 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-06-20 02:04 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICustomerCare]
2010-03-04 21:31 311296 ----a-w- c:\program files\ATI\ATICustomerCare\ATICustomerCare.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2010-04-01 09:16 357696 ----a-w- c:\program files\DAEMON Tools Lite\DTLite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\F5D9050]
2006-02-14 22:19 1531904 ----a-w- c:\program files\Belkin\F5D9050\Belkinwcui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]
2010-04-29 22:39 437584 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Pando Media Booster]
2010-08-09 02:33 2937528 ----a-w- c:\program files\Pando Networks\Media Booster\PMB.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
2009-03-05 23:07 2260480 --sha-r- c:\program files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
2010-05-27 19:34 98304 ----a-w- c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2010-05-08 11:08 1238352 ----a-w- c:\program files\Steam\Steam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-05-14 18:44 248552 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
2009-12-21 05:45 39424 ----a-w- c:\program files\Winamp\winampa.exe

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 ALSysIO;ALSysIO;c:\users\Chan\AppData\Local\Temp\ALSysIO.sys [x]
R3 avg9emc;AVG Free E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [2010-07-20 921952]
R3 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [2010-07-15 308136]
R3 BKNDIS5;BKNDIS5 NDIS Protocol Driver;c:\progra~1\Belkin\F5D9050\BKNDIS5.SYS [2005-03-02 15872]
R3 EmmaDevMgmtSvc;Emma Device Management;c:\program files\Common Files\Sony Ericsson\Emma Core\Services\EmmaDeviceMgmt.exe [2010-07-02 306296]
R3 EmmaUpdMgmtSvc;Emma Update Management;c:\program files\Common Files\Sony Ericsson\Emma Core\Services\EmmaUpdateMgmt.exe [2010-07-02 162936]
R3 GarenaPEngine;GarenaPEngine;c:\users\Chan\AppData\Local\Temp\FLX804C.tmp [x]
R3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys [2009-04-06 13224]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2010-04-29 20952]
R3 netr73;Belkin Wireless G Plus MIMO USB Network Adapter Driver for Vista;c:\windows\system32\DRIVERS\netr73.sys [2007-11-12 468480]
R3 s0016bus;Sony Ericsson Device 0016 driver (WDM);c:\windows\system32\DRIVERS\s0016bus.sys [2008-05-16 89256]
R3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s0016mdfl.sys [2008-05-16 15016]
R3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s0016mdm.sys [2008-05-16 120744]
R3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s0016mgmt.sys [2008-05-16 114216]
R3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS);c:\windows\system32\DRIVERS\s0016nd5.sys [2008-05-16 25512]
R3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s0016obex.sys [2008-05-16 110632]
R3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM);c:\windows\system32\DRIVERS\s0016unic.sys [2008-05-16 115752]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-03-29 1343400]
R4 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-05-27 176128]
R4 DAUpdaterSvc;Dragon Age: Origins - Content Updater;c:\program files\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe [2009-12-15 25832]
R4 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2010-04-29 304464]
R4 OMSI download service;Sony Ericsson OMSI download service;c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe [2009-04-30 90112]
R4 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
R4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys [2010-07-29 691696]
R4 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2010-04-03 240232]
S1 a2injectiondriver;a2injectiondriver;c:\program files\Emsisoft Anti-Malware\a2dix86.sys [2010-08-13 41816]
S1 a2util;a-squared Malware-IDS utility driver;c:\program files\Emsisoft Anti-Malware\a2util32.sys [2010-05-05 11776]
S1 aswSP;avast! Self Protection; [x]
S1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\Drivers\avgldx86.sys [2010-07-15 216400]
S1 AvgTdiX;AVG Free Network Redirector;c:\windows\System32\Drivers\avgtdix.sys [2010-07-15 243024]
S2 a2AntiMalware;Emsisoft Anti-Malware 5.0 - Service;c:\program files\Emsisoft Anti-Malware\a2service.exe [2010-07-28 1935656]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2009-11-24 20560]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\DRIVERS\aswMonFlt.sys [2009-11-24 53328]
S2 cpuz133;cpuz133;c:\windows\system32\drivers\cpuz133_x32.sys [2010-03-31 20968]
S3 a2acc;a2acc;c:\program files\EMSISOFT ANTI-MALWARE\a2accx86.sys [2010-06-28 71008]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2010-05-27 5586432]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2010-05-27 209920]
S3 L1C;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20);c:\windows\system32\DRIVERS\L1C62x86.sys [2009-07-27 51712]
S3 nvoclock;NVIDIA Enthusiasts Platform KDM;c:\windows\system32\DRIVERS\nvoclock.sys [2009-09-15 38248]
S3 StreamSurge;StreamSurge Driver (miniport);c:\windows\system32\DRIVERS\ss.sys [2005-06-18 19968]

.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com
mStart Page = hxxp://www.yahoo.com
FF - ProfilePath - c:\users\Chan\AppData\Roaming\Mozilla\Firefox\Profiles\s04jin69.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\NVIDIA Corporation\3D Vision\npnv3dv.dll
FF - plugin: c:\programdata\NexonUS\NGM\npNxGameUS.dll
.
- - - - ORPHANS REMOVED - - - -

SafeBoot-dmboot.sys
SafeBoot-dmio.sys
SafeBoot-dmload.sys
SafeBoot-dmadmin
SafeBoot-dmserver
SafeBoot-SRService
MSConfigStartUp-SUPERAntiSpyware - c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe



**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll >>UNKNOWN [0x86C41B4C]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
IoDeviceObjectType -> DumpProcedure -> 0xd46a624f
SecurityProcedure -> 0x859e47b8
QueryNameProcedure -> 0x85974810
user & kernel MBR OK

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\GarenaPEngine]
"ImagePath"="\??\c:\users\Chan\AppData\Local\Temp\FLX804C.tmp"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\conhost.exe
c:\program files\Alwil Software\Avast4\ashDisp.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\Adobe\Reader 9.0\Reader\AcroRd32.exe
.
**************************************************************************
.
Completion time: 2010-08-17 01:44:06 - machine was rebooted
ComboFix-quarantined-files.txt 2010-08-17 08:44
ComboFix2.txt 2010-08-10 06:21
ComboFix3.txt 2010-07-29 00:21

Pre-Run: 96,067,010,560 bytes free
Post-Run: 95,560,896,512 bytes free

- - End Of File - - 6D6D51FFB41829DE261A62041E13EAB7

Still getting redirects. Thanks for the assistance so far tho, much appreciated.

Please download MBRCheck.exe by a_d_13 from one of the links provided below and save it to your desktop.

Link 1
Link 2
Link 3

• Double-click on MBRCheck.exe to run it.
  
• It will open a black window...please do not fix anything (if it gives you an option).
  
• When complete, you should see Done! Press ENTER to exit.... Press Enter on the keyboard.
  
• A log named MBRCheck_date_time.txt (i.e. MBRCheck_07.21.10_10.22.51.txt) will appear on the desktop.
  
• Please copy and paste the contents of that log in your next reply.

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows 7 Ultimate Edition
Windows Information: (build 7600), 32-bit
Base Board Manufacturer: Gigabyte Technology Co., Ltd.
BIOS Manufacturer: Award Software International, Inc.
System Manufacturer: Gigabyte Technology Co., Ltd.
System Product Name: G31M-ES2L
Logical Drives Mask: 0x00000005

Kernel Drivers (total 179):
0x82E4A000 \SystemRoot\system32\ntkrnlpa.exe
0x82E13000 \SystemRoot\system32\halmacpi.dll
0x86D02000 \SystemRoot\system32\kdcom.dll
0x8343D000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x834B5000 \SystemRoot\system32\PSHED.dll
0x834C6000 \SystemRoot\system32\BOOTVID.dll
0x834CE000 \SystemRoot\system32\CLFS.SYS
0x83510000 \SystemRoot\system32\CI.dll
0x83613000 \SystemRoot\system32\drivers\Wdf01000.sys
0x83684000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x83692000 \SystemRoot\system32\DRIVERS\ACPI.sys
0x836DA000 \SystemRoot\system32\DRIVERS\WMILIB.SYS
0x836E3000 \SystemRoot\system32\DRIVERS\msisadrv.sys
0x836EB000 \SystemRoot\system32\DRIVERS\vdrvroot.sys
0x836F6000 \SystemRoot\system32\DRIVERS\pci.sys
0x83720000 \SystemRoot\System32\drivers\partmgr.sys
0x83731000 \SystemRoot\system32\DRIVERS\volmgr.sys
0x83741000 \SystemRoot\System32\drivers\volmgrx.sys
0x8378C000 \SystemRoot\system32\DRIVERS\intelide.sys
0x83793000 \SystemRoot\system32\DRIVERS\PCIIDEX.SYS
0x837A1000 \SystemRoot\System32\drivers\mountmgr.sys
0x837B7000 \SystemRoot\system32\DRIVERS\atapi.sys
0x837C0000 \SystemRoot\system32\DRIVERS\ataport.SYS
0x837E3000 \SystemRoot\system32\DRIVERS\amdxata.sys
0x835BB000 \SystemRoot\system32\drivers\fltmgr.sys
0x837EC000 \SystemRoot\system32\drivers\fileinfo.sys
0x8BC08000 \SystemRoot\System32\Drivers\Ntfs.sys
0x8BD37000 \SystemRoot\System32\Drivers\msrpc.sys
0x8BD62000 \SystemRoot\System32\Drivers\ksecdd.sys
0x8BD75000 \SystemRoot\System32\Drivers\cng.sys
0x8BDD2000 \SystemRoot\System32\drivers\pcw.sys
0x8BDE0000 \SystemRoot\System32\Drivers\Fs_Rec.sys
0x8BE31000 \SystemRoot\system32\drivers\ndis.sys
0x8BEE8000 \SystemRoot\system32\drivers\NETIO.SYS
0x8BF26000 \SystemRoot\System32\Drivers\ksecpkg.sys
0x8C02D000 \SystemRoot\System32\drivers\tcpip.sys
0x8C176000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x8C1A7000 \SystemRoot\system32\DRIVERS\vmstorfl.sys
0x8C1B0000 \SystemRoot\system32\DRIVERS\volsnap.sys
0x8C1EF000 \SystemRoot\System32\Drivers\spldr.sys
0x8C000000 \SystemRoot\System32\drivers\rdyboost.sys
0x8BF4B000 \SystemRoot\System32\Drivers\mup.sys
0x8C1F7000 \SystemRoot\System32\drivers\hwpolicy.sys
0x8BF5B000 \SystemRoot\System32\DRIVERS\fvevol.sys
0x8BF8D000 \SystemRoot\system32\DRIVERS\disk.sys
0x8BF9E000 \SystemRoot\system32\DRIVERS\CLASSPNP.SYS
0x8BE1F000 \??\C:\Program Files\Emsisoft Anti-Malware\a2dix86.sys
0x8BE28000 \SystemRoot\System32\Drivers\Null.SYS
0x8BFF5000 \SystemRoot\System32\Drivers\Beep.SYS
0x8BE00000 \SystemRoot\System32\drivers\vga.sys
0x83400000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x8BE0C000 \SystemRoot\System32\drivers\watchdog.sys
0x8BDE9000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x8BDF1000 \SystemRoot\system32\drivers\rdpencdd.sys
0x8BC00000 \SystemRoot\system32\drivers\rdprefmp.sys
0x83600000 \SystemRoot\System32\Drivers\Msfs.SYS
0x83421000 \SystemRoot\System32\Drivers\Npfs.SYS
0x91438000 \SystemRoot\system32\DRIVERS\tdx.sys
0x9144F000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x9145A000 \SystemRoot\System32\Drivers\avgtdix.sys
0x91494000 \SystemRoot\System32\DRIVERS\netbt.sys
0x914C6000 \SystemRoot\System32\Drivers\aswTdi.SYS
0x914D0000 \SystemRoot\system32\drivers\afd.sys
0x9152A000 \SystemRoot\System32\Drivers\aswRdr.SYS
0x9152E000 \SystemRoot\system32\DRIVERS\wfplwf.sys
0x91535000 \SystemRoot\system32\DRIVERS\pacer.sys
0x91554000 \SystemRoot\system32\DRIVERS\netbios.sys
0x91562000 \SystemRoot\system32\DRIVERS\serial.sys
0x9157C000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x9158F000 \SystemRoot\system32\DRIVERS\termdd.sys
0x9159F000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x915E0000 \SystemRoot\system32\drivers\nsiproxy.sys
0x915EA000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x915F4000 \SystemRoot\System32\drivers\discache.sys
0x91804000 \SystemRoot\system32\drivers\csc.sys
0x91868000 \SystemRoot\System32\Drivers\dfsc.sys
0x91880000 \SystemRoot\system32\DRIVERS\blbdrive.sys
0x9188E000 \SystemRoot\System32\Drivers\avgmfx86.sys
0x91894000 \SystemRoot\System32\Drivers\avgldx86.sys
0x918C8000 \SystemRoot\System32\Drivers\aswSP.SYS
0x918E9000 \??\C:\Program Files\Emsisoft Anti-Malware\a2util32.sys
0x918EB000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x9190C000 \SystemRoot\system32\DRIVERS\intelppm.sys
0x9191E000 \SystemRoot\system32\DRIVERS\atikmpag.sys
0x92018000 \SystemRoot\system32\DRIVERS\atikmdag.sys
0x92616000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x926CD000 \SystemRoot\System32\drivers\dxgmms1.sys
0x92706000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x92725000 \SystemRoot\system32\DRIVERS\L1C62x86.sys
0x92735000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0x92740000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x9278B000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x9279A000 \SystemRoot\system32\DRIVERS\fdc.sys
0x927A5000 \SystemRoot\system32\DRIVERS\serenum.sys
0x927AF000 \SystemRoot\system32\DRIVERS\parport.sys
0x927C7000 \SystemRoot\system32\DRIVERS\CompositeBus.sys
0x927D4000 \SystemRoot\system32\DRIVERS\AgileVpn.sys
0x927E6000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x92600000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x925BB000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x925DD000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x92000000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x91956000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x9260B000 \SystemRoot\system32\DRIVERS\rdpbus.sys
0x9196D000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x9197A000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x927FE000 \SystemRoot\system32\DRIVERS\swenum.sys
0x91987000 \SystemRoot\system32\DRIVERS\ks.sys
0x925F5000 \SystemRoot\system32\DRIVERS\nvoclock.sys
0x919BB000 \SystemRoot\system32\DRIVERS\umbus.sys
0x919C9000 \SystemRoot\system32\DRIVERS\ss.sys
0x9323E000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x93282000 \SystemRoot\system32\DRIVERS\flpydisk.sys
0x9328C000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x9329D000 \SystemRoot\system32\drivers\AtiHdmi.sys
0x932BB000 \SystemRoot\system32\drivers\portcls.sys
0x932EA000 \SystemRoot\system32\drivers\drmk.sys
0x9583D000 \SystemRoot\system32\drivers\RTKVHDA.sys
0x95B22000 \SystemRoot\System32\Drivers\crashdmp.sys
0x95B2F000 \SystemRoot\System32\Drivers\dump_dumpata.sys
0x95B3A000 \SystemRoot\System32\Drivers\dump_atapi.sys
0x95B43000 \SystemRoot\System32\Drivers\dump_dumpfve.sys
0x99160000 \SystemRoot\System32\win32k.sys
0x95B54000 \SystemRoot\System32\drivers\Dxapi.sys
0x95B5E000 \SystemRoot\System32\Drivers\LUsbFilt.Sys
0x95B64000 \SystemRoot\system32\DRIVERS\hidusb.sys
0x95B6F000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0x95B82000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x95B89000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x95B8B000 \SystemRoot\system32\DRIVERS\LHidFilt.Sys
0x95B93000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x95B9E000 \SystemRoot\system32\DRIVERS\LMouFilt.Sys
0x95BA6000 \SystemRoot\system32\DRIVERS\usbprint.sys
0x95BB1000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0x95BC8000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0x95BD4000 \SystemRoot\system32\drivers\usbaudio.sys
0x95BE8000 \SystemRoot\system32\DRIVERS\monitor.sys
0x993C0000 \SystemRoot\System32\TSDDD.dll
0x99000000 \SystemRoot\System32\cdd.dll
0x95800000 \SystemRoot\system32\drivers\luafv.sys
0x9581B000 \SystemRoot\system32\DRIVERS\aswMonFlt.sys
0x95832000 \SystemRoot\system32\DRIVERS\aswFsBlk.sys
0x93303000 \SystemRoot\system32\drivers\WudfPf.sys
0x95BF3000 \SystemRoot\system32\DRIVERS\AegisP.sys
0x9331D000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x9332D000 \SystemRoot\system32\DRIVERS\nwifi.sys
0x93373000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x93383000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x9B60F000 \SystemRoot\system32\drivers\HTTP.sys
0x9B694000 \SystemRoot\system32\DRIVERS\bowser.sys
0x9B6AD000 \SystemRoot\System32\drivers\mpsdrv.sys
0x9B6BF000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0x9B6E2000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0x9B71D000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0x9B738000 \SystemRoot\system32\DRIVERS\parvdm.sys
0x9B73F000 \SystemRoot\system32\DRIVERS\atksgt.sys
0x9B782000 \??\C:\Windows\system32\drivers\cpuz132_x32.sys
0x9B786000 \??\C:\Windows\system32\drivers\cpuz133_x32.sys
0x9B78F000 \??\C:\PROGRAM FILES\EMSISOFT ANTI-MALWARE\a2accx86.sys
0x9B79F000 \SystemRoot\system32\DRIVERS\lirsgt.sys
0x9C83C000 \SystemRoot\system32\drivers\peauth.sys
0x9C8D3000 \SystemRoot\System32\Drivers\secdrv.SYS
0x9C8DD000 \SystemRoot\System32\DRIVERS\srvnet.sys
0x9C968000 \SystemRoot\System32\drivers\tcpipreg.sys
0x9C975000 \SystemRoot\System32\DRIVERS\srv2.sys
0x9B7A4000 \SystemRoot\System32\DRIVERS\srv.sys
0x77150000 \Windows\System32\ntdll.dll
0x480B0000 \Windows\System32\smss.exe
0x77390000 \Windows\System32\apisetschema.dll
0x00B30000 \Windows\System32\autochk.exe
0x77370000 \Windows\System32\nsi.dll
0x76500000 \Windows\System32\shell32.dll
0x77360000 \Windows\System32\psapi.dll
0x77300000 \Windows\System32\shlwapi.dll
0x772A0000 \Windows\System32\difxapi.dll
0x77290000 \Windows\System32\normaliz.dll
0x76300000 \Windows\System32\iertutil.dll
0x76270000 \Windows\System32\oleaut32.dll
0x76190000 \Windows\System32\kernel32.dll

Processes (total 43):
0 System Idle Process
4 System
296 C:\Windows\System32\smss.exe
420 csrss.exe
496 C:\Windows\System32\wininit.exe
508 csrss.exe
548 C:\Windows\System32\services.exe
564 C:\Windows\System32\lsass.exe
572 C:\Windows\System32\lsm.exe
692 C:\Windows\System32\svchost.exe
740 C:\Windows\System32\winlogon.exe
828 C:\Windows\System32\svchost.exe
924 C:\Windows\System32\svchost.exe
960 C:\Windows\System32\svchost.exe
1032 C:\Windows\System32\svchost.exe
1108 C:\Windows\System32\audiodg.exe
1192 C:\Windows\System32\svchost.exe
1332 C:\Windows\System32\svchost.exe
1432 C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
1460 C:\Program Files\Alwil Software\Avast4\ashServ.exe
1684 C:\Windows\System32\spoolsv.exe
1716 C:\Windows\System32\svchost.exe
1800 C:\Program Files\Emsisoft Anti-Malware\a2service.exe
2016 C:\Windows\System32\svchost.exe
2272 C:\Windows\System32\svchost.exe
2520 C:\Windows\System32\dwm.exe
2544 C:\Windows\System32\taskhost.exe
2624 C:\Windows\explorer.exe
2828 C:\Program Files\Alwil Software\Avast4\ashDisp.exe
2836 C:\Program Files\Common Files\Java\Java Update\jusched.exe
2952 C:\Windows\System32\SearchIndexer.exe
3064 C:\Program Files\Windows Media Player\wmpnetwk.exe
3228 C:\Windows\System32\svchost.exe
3516 C:\Windows\System32\svchost.exe
3544 WmiPrvSE.exe
3688 C:\Program Files\AIM\aim.exe
4036 C:\Program Files\Mozilla Firefox 4.0 Beta 2\firefox.exe
3088 taskhost.exe
3552 C:\Windows\System32\SearchProtocolHost.exe
3412 C:\Windows\System32\SearchFilterHost.exe
3784 C:\Windows\System32\dllhost.exe
3592 C:\Users\Chan\Downloads\MBRCheck.exe
3676 C:\Windows\System32\conhost.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`06500000 (NTFS)

PhysicalDrive0 Model Number: ST3500418AS, Rev: CC38

Size Device Name MBR Status
--------------------------------------------
465 GB \\.\PhysicalDrive0 MBR Code Faked!
SHA1: 1BB72AA843C54C64E74C9F6C9BD22FA2AFA08966


Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:

Done!

Fix using MBRCheck.exe

Run MBRCheck.exe again by double-clicking on it.

• Wait until you see the following line: Enter 'Y' and hit ENTER for more options, or 'N' to exit:
  
• Enter 'Y' and then press Enter.
  
• When asked: 'Enter your choice:', select option 2 (Restore the MBR of a physical disk with a standard boot code) and press the Enter key.
  
• Now the program will ask: 'Enter the physical disk number to fix (0-99, -1 to cancel)'
  
• Enter 0 and press the Enter key.
  
• The program will show Available MBR codes followed by a list of operating systems as shown below:
  

  Available MBR codes:
  [ 0] Default (Windows XP)
  [ 1] Windows XP
  [ 2] Windows Server 2003
  [ 3] Windows Vista
  [ 4] Windows 2008
  [ 5] Windows 7
  [-1] Cancel
  Please select the MBR code to write to this drive:
  

• Please select your version of Windows from the list and enter the corresponding number and then press Enter.
  
• When prompted for confirmation: "Do you want to fix the MBR code?". Type the full word Yes (not Y or the fix will not work) and press Enter.
  
• Left-click on the title bar (where program name and path is written).
  
• From the menu chose Edit -> Select All.
  
• Press the Enter key to copy selected text.
  
• Open Notepad, paste that text into it and save to your desktop as MBRCheck.txt.
  
• When complete, you should see Done! Press ENTER to exit.... Press Enter on the keyboard.
  
• Reboot your computer to complete the fix and copy/paste MBRCheck.txt in your next reply.
  
• If your computer does not restart on its own, please restart it manually.
  

Important Note: The Master Boot Record contains the Partition Table for the hard disk and a a little executable code for the boot start. While fixing the Master Boot Record (MBR) is generally safe, there is a small risk of damaging the MBR, which may cause the computer to not boot up or it may corrupt a partition.

The following are signs of a damaged MBR:

• Invalid Partition Table
  
• Missing Operating System
  
• Error loading operating system

If it is the worst case scenario, and your computer cannot boot, please take note of the following:

Please have your Windows CD available, which will allow recovering the boot code via the Windows Recovery Console in case of any problems or install the XP Recovery Console before proceeding with the above fix. Then, if any problems occur, the links below explain how to use and repair the MBR:

• How to use the Recovery Console
• How to fix MBR in Windows XP and Vista

If you do not have a Windows CD available, please let me know. You will need access to a computer that can burn CDs.

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows 7 Ultimate Edition
Windows Information: (build 7600), 32-bit
Base Board Manufacturer: Gigabyte Technology Co., Ltd.
BIOS Manufacturer: Award Software International, Inc.
System Manufacturer: Gigabyte Technology Co., Ltd.
System Product Name: G31M-ES2L
Logical Drives Mask: 0x00000005

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`06500000 (NTFS)

Size Device Name MBR Status
--------------------------------------------
465 GB \\.\PhysicalDrive0 MBR Code Faked!
SHA1: 1BB72AA843C54C64E74C9F6C9BD22FA2AFA08966


Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit: y

Options:
[1] Dump the MBR of a physical disk to file.
[2] Restore the MBR of a physical disk with a standard boot code.
[3] Exit.

Enter your choice: 2

Enter the physical disk number to fix (0-99, -1 to cancel): 0
Available MBR codes:
[ 0] Default (Windows 7)
[ 1] Windows XP
[ 2] Windows Server 2003
[ 3] Windows Vista
[ 4] Windows 2008
[ 5] Windows 7
[-1] Cancel

Please select the MBR code to write to this drive: 5
Do you want to fix the MBR code? Type 'YES' and hit ENTER to continue: YES
Successfully wrote new MBR code!
Please reboot your computer to complete the fix.


Done!
Press ENTER to exit...

Download Bootkit Remover to your Desktop.

• You then need to extract the remover.exe file from the RAR using a program capable of extracing RAR compressed files. If you don't have an extraction program, you can use 7-Zip: http://www.7-zip.org/
  
• After extracing remover.exe to your Desktop, let it stay put, then do the following:

Please open Notepad and enter in the following:

@echo off
start remover.exe fix \.\PhysicalDrive0
exit

Then, click File > Save as...
Save as remove.bat to the same location as remover.exe.
Choose Save as type... All Files.
Click Save.

Then, exit Notepad.

Double-click on remove.bat.

It may ask to reboot the computer. Let it do so.

After that, do this:

Please double-click on remover.exe and post a new log in your next reply.

Important Note: The Master Boot Record contains the Partition Table for the hard disk and a a little executable code for the boot start. While fixing the Master Boot Record (MBR) is generally safe, there is a small risk of damaging the MBR, which may cause the computer to not boot up or it may corrupt a partition.

The following are signs of a damaged MBR:

• Invalid Partition Table
  
• Missing Operating System
  
• Error loading operating system

If it is the worst case scenario, and your computer cannot boot, please take note of the following:

Please have your Windows CD available, which will allow recovering the boot code via the Windows Recovery Console in case of any problems or install the XP Recovery Console before proceeding with the above fix. Then, if any problems occur, the links below explain how to use and repair the MBR:

• How to use the Recovery Console
• How to fix MBR in Windows XP and Vista

If you do not have a Windows CD available, please let me know. You will need access to a computer that can burn CDs.

It said ERROR 2.. can't open physical drive

Do you have a Windows 7 DVD?

We need to get in to the Recovery options to fix the MBR.

It is a data-safe operation.

I don't have a dvd or cd-rom drive on my current set up but I can get try to get a hold of recovery options through a flash drive. This might take me some time as I will have to borrow a flash drive from a friend.

Actually, see if you can get in to this: http://support.microsoft.com/kb/927392

(Bootrec from Startup Repair.)

Except, you won't need the DVD.

On Windows boot, type F8, then key down to the Startup Repair option.