Alureon-G@mbr Virus- Description, OTL, Extras, ASW, Checkup

i dont know whats up but somethings not right.... it doesnt show cpu or processor being used barely at all. task bar missing, avast doesnt even open up... it is odd... but not good... ugh! I had no idea what i was getting in to.... lol

restarted computer and task bar and start button are back. remembered earlier problem of fire wall being off so i tried to open security center and it wont open. Also Avast wont run now. And everything is running at snails pace

Please download MBRCheck.exe by a_d_13 from one of the links provided below and save it to your desktop.

Link 1
Link 2
Link 3

• Double-click on MBRCheck.exe to run it.
  
• It will open a black window...please do not fix anything (if it gives you an option).
  
• When complete, you should see Done! Press ENTER to exit.... Press Enter on the keyboard.
  
• A log named MBRCheck_date_time.txt (i.e. MBRCheck_07.21.10_10.22.51.txt) will appear on the desktop.
  
• Please copy and paste the contents of that log in your next reply.

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Professional
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x0000000d

Kernel Drivers (total 128):
0x804D7000 \WINDOWS\system32\ntoskrnl.exe
0x806EF000 \WINDOWS\system32\hal.dll
0xF8B76000 \WINDOWS\system32\KDCOM.DLL
0xF8A86000 \WINDOWS\system32\BOOTVID.dll
0xF88F6000 usbuhci.sys
0xF8631000 \WINDOWS\system32\DRIVERS\USBPORT.SYS
0xF8676000 usbhub.sys
0xF8B78000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xF8B7A000 \WINDOWS\system32\DRIVERS\USBD.SYS
0xF8603000 ACPI.sys
0xF85F2000 pci.sys
0xF8686000 isapnp.sys
0xF8A8A000 compbatt.sys
0xF8A8E000 \WINDOWS\system32\DRIVERS\BATTC.SYS
0xF8B7C000 intelide.sys
0xF8906000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
0xF85D4000 pcmcia.sys
0xF8696000 MountMgr.sys
0xF85B5000 ftdisk.sys
0xF8B7E000 dmload.sys
0xF858F000 dmio.sys
0xF8A92000 ACPIEC.sys
0xF8C3E000 \WINDOWS\system32\DRIVERS\OPRGHDLR.SYS
0xF890E000 PartMgr.sys
0xF8C3F000 OzCrd2k.sys
0xF86A6000 VolSnap.sys
0xF8577000 atapi.sys
0xF86B6000 disk.sys
0xF86C6000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xF8557000 fltMgr.sys
0xF8545000 sr.sys
0xF852E000 KSecDD.sys
0xF84A1000 Ntfs.sys
0xF8474000 NDIS.sys
0xF845A000 Mup.sys
0xF86D6000 agp440.sys
0xF7C8D000 \SystemRoot\system32\DRIVERS\nv4_mini.sys
0xF7C79000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xF7C67000 \SystemRoot\system32\DRIVERS\el90xbc5.sys
0xF7C08000 \SystemRoot\system32\DRIVERS\tnet1130x.sys
0xF8866000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0xF894E000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xF8956000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xF7BF4000 \SystemRoot\system32\DRIVERS\parport.sys
0xF895E000 \SystemRoot\system32\DRIVERS\fdc.sys
0xF8B6A000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0xF8876000 \SystemRoot\system32\DRIVERS\imapi.sys
0xF8886000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xF8896000 \SystemRoot\system32\DRIVERS\redbook.sys
0xF7BD1000 \SystemRoot\system32\DRIVERS\ks.sys
0xF7BB9000 \SystemRoot\system32\drivers\STAC97.sys
0xF7B95000 \SystemRoot\system32\drivers\portcls.sys
0xF88A6000 \SystemRoot\system32\drivers\drmk.sys
0xF7B64000 \SystemRoot\system32\DRIVERS\HSFHWICH.sys
0xF7A65000 \SystemRoot\system32\DRIVERS\HSF_DP.sys
0xF79BF000 \SystemRoot\system32\DRIVERS\HSF_CNXT.sys
0xF8966000 \SystemRoot\System32\Drivers\Modem.SYS
0xF8C96000 \SystemRoot\system32\DRIVERS\audstub.sys
0xF88B6000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xF8B72000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xF79A8000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xF88C6000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xF88D6000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xF896E000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xF7996000 \SystemRoot\system32\DRIVERS\psched.sys
0xF88E6000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xF8976000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xF897E000 \SystemRoot\system32\DRIVERS\raspti.sys
0xF86F6000 \SystemRoot\system32\DRIVERS\odysseyIM3.sys
0xF7966000 \SystemRoot\system32\DRIVERS\rdpdr.sys
0xF8706000 \SystemRoot\system32\DRIVERS\termdd.sys
0xF8BA4000 \SystemRoot\system32\DRIVERS\swenum.sys
0xF7908000 \SystemRoot\system32\DRIVERS\update.sys
0xF841A000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xF8986000 \SystemRoot\system32\DRIVERS\omci.sys
0xF87E6000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xF8A6E000 \SystemRoot\system32\DRIVERS\flpydisk.sys
0xF657C000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xF8D29000 \SystemRoot\System32\Drivers\Null.SYS
0xF8C14000 \SystemRoot\System32\Drivers\Beep.SYS
0xF568F000 \SystemRoot\System32\drivers\vga.sys
0xF8C16000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xF5687000 \SystemRoot\System32\Drivers\Msfs.SYS
0xF567F000 \SystemRoot\System32\Drivers\Npfs.SYS
0xF6578000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xF502B000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xF4FD2000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xF637A000 \SystemRoot\System32\Drivers\aswTdi.SYS
0xF4E92000 \SystemRoot\system32\DRIVERS\netbt.sys
0xF5677000 \SystemRoot\System32\Drivers\aswRdr.SYS
0xF4E70000 \SystemRoot\System32\drivers\afd.sys
0xF8836000 \SystemRoot\system32\DRIVERS\netbios.sys
0xF4E45000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xF4DD5000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xF5B4F000 \SystemRoot\System32\Drivers\Fips.SYS
0xF4DAF000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xF5B0F000 \SystemRoot\system32\DRIVERS\wanarp.sys
0xF2AD8000 \SystemRoot\System32\Drivers\aswSP.SYS
0xF2A68000 \SystemRoot\System32\Drivers\aswSnx.SYS
0xF348E000 \SystemRoot\System32\Drivers\Aavmker4.SYS
0xF2F79000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xF8B26000 \SystemRoot\System32\drivers\Dxapi.sys
0xF3080000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xF8C99000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF012000 \SystemRoot\System32\nv4_disp.dll
0xBF343000 \SystemRoot\System32\ATMFD.DLL
0xF323D000 \SystemRoot\System32\Drivers\aswFsBlk.SYS
0xF3225000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xF2FB9000 \SystemRoot\system32\DRIVERS\rspndr.sys
0xF06EB000 \SystemRoot\System32\Drivers\aswMon2.SYS
0xF05A7000 \SystemRoot\system32\DRIVERS\mrxdav.sys
0xF8B9E000 \SystemRoot\System32\Drivers\ParVdm.SYS
0xF0583000 \SystemRoot\system32\DRIVERS\mdmxsdk.sys
0xF04D7000 \SystemRoot\system32\DRIVERS\srv.sys
0xF0242000 \SystemRoot\system32\drivers\wdmaud.sys
0xF6823000 \SystemRoot\system32\drivers\sysaudio.sys
0xF8BB6000 \SystemRoot\system32\drivers\splitter.sys
0xF021F000 \SystemRoot\system32\drivers\aec.sys
0xF8816000 \SystemRoot\system32\drivers\swmidi.sys
0xF355E000 \SystemRoot\system32\drivers\DMusic.sys
0xF01F4000 \SystemRoot\system32\drivers\kmixer.sys
0xF8CB0000 \SystemRoot\system32\drivers\drmkaud.sys
0xF0043000 \SystemRoot\System32\Drivers\HTTP.sys
0xEFF7F000 \SystemRoot\System32\Drivers\Fastfat.SYS
0xEFF1F000 \??\C:\WINDOWS\system32\CBTNDIS5.SYS
0x7C900000 \WINDOWS\system32\ntdll.dll

Processes (total 27):
0 System Idle Process
4 System
880 C:\WINDOWS\system32\smss.exe
972 csrss.exe
1016 C:\WINDOWS\system32\winlogon.exe
1060 C:\WINDOWS\system32\services.exe
1072 C:\WINDOWS\system32\lsass.exe
1228 C:\WINDOWS\system32\svchost.exe
1292 svchost.exe
1348 C:\WINDOWS\system32\svchost.exe
1552 svchost.exe
1704 svchost.exe
1916 C:\Program Files\AVAST Software\Avast\AvastSvc.exe
636 C:\WINDOWS\system32\spoolsv.exe
712 svchost.exe
952 C:\WINDOWS\system32\nvsvc32.exe
992 C:\WINDOWS\system32\snmp.exe
1256 C:\WINDOWS\system32\svchost.exe
1812 alg.exe
500 C:\WINDOWS\explorer.exe
2252 C:\Program Files\AVAST Software\Avast\AvastUI.exe
2388 C:\WINDOWS\system32\ctfmon.exe
2464 C:\PROGRA~1\Linksys\WIRELE~1\OdHost.exe
2504 C:\PROGRA~1\Linksys\WIRELE~1\WPC54CFG.exe
2128 C:\WINDOWS\system32\wuauclt.exe
268 C:\Documents and Settings\Owner\desktop\MBRCheck.exe
2660 C:\Program Files\AVAST Software\Avast\Setup\avast.setup

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)

PhysicalDrive0 Model Number: HITACHI_DK23EB-40, Rev: 00K0A0C0

Size Device Name MBR Status
--------------------------------------------
37 GB \\.\PhysicalDrive0 Windows XP MBR code detected
SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A


Done!

Delete any old copies of this program...

Please visit this webpage for a tutorial on downloading and running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

See the area: Using ComboFix, and when done, post the log back here.