0

Hey guys,

My AV has located a rootkit MBR:\\.\PHYSICALDRIVE0

I have already tried a solution that I found in this forum but it has not worked.

basically I have run bootkit_remover.rar and run it.

It returned the following:

--

Bootkit Remover
(c) 2009 eSage Lab
www.esagelab.com

Program version: 1.2.0.0
OS Version: Microsoft Windows 7 Home Premium Edition (build 7600), 64-bit

System volume is \\.\C:
\\.\C: -> \\.\PhysicalDrive0 at offset 0x00000000`0c800000

Size Device Name MBR Status
--------------------------------------------
465 GB \\.\PhysicalDrive0 Controlled by rootkit!

Boot code on some of your physical disks is hidden by a rootkit.
To disinfect the master boot sector, use the following command:
remover.exe fix <device_name>
To inspect the boot code manually, dump the master boot sector:
remover.exe dump <device_name> [output_file]


Done;
Press any key to quit...

--

I then added a fix .dat with the following content:

@ECHO OFF
START remover.exe fix \\.\PhysicalDrive0
EXIT

Then ran remover again and got the same output.

As for the initial scans you ask for:

Ran Windows Malicious Software Removal Tool - No threats found

RAN ATF Cleaner

Ran GMER - Logs below:

--

GMER 1.0.15.15530 - http://www.gmer.net
Rootkit scan 2011-03-10 09:33:46
Windows 6.1.7600
Running: sw9bi1b5.exe


---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager@PendingFileRenameOperations ???o??????????????????????????????????????????????????????????3???????????6???????????5?????????????????$???4????? ??????? ??????????????????????????????????????????????????????? ??????????? ??????????? ??????????????? ???%????c??HJ???x???????????????=???=???=???f??????????8????????=???=???x???????????g???x?????????????????????????? ????e???e?????????? ????=?????? ????????????e????\??\C:\Users\Tgon\Local Settings\temp\(rare.Indian.Teen.16.Porn.).torrent??\??\C:\Users\Tgon\Local Settings\temp\10.OClock.Live.S01E01.WS.PDTV.XviD-PVR.[eztv].torrent??\??\C:\Users\Tgon\Local Settings\temp\10.OClock.Live.S01E07.WS.PDTV.XviD-aAF.[eztv].torrent??\??\C:\Users\Tgon\Local Settings\temp\15692F69F0386BBA46A98DBF750DA6F99C1D4843.torrent??\??\C:\Users\Tgon\Local Settings\temp\19.Years.Old.Indian.Teen.torrent??\??\C:\Users\Tgon\Local Settings\temp\And_Soon_The_Darkness_2010_480p_BRRip_XviD_AC3-MECK90.6051877.TPB.torrent??\??\C:\Users\Tgon\Local Settings\temp\BBC.Billy.Connollys.World.Tour.of.New.Zealand.8of8.XviD.AC3.[MVGrou
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\00271378bece
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@s2 285507792
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xCA 0x56 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x7E 0xB4 0x7E 0x73 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files (x86)\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0xA0 0x02 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x07 0x65 0xEE 0xEB ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x83 0xD9 0xC5 0xC8 ...
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\00271378bece (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xCA 0x56 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x7E 0xB4 0x7E 0x73 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files (x86)\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0xA0 0x02 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x07 0x65 0xEE 0xEB ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x83 0xD9 0xC5 0xC8 ...

---- EOF - GMER 1.0.15 ----


Ran Malwarebytes Anti-Malware, no threats found

DDS scan logs below:

one -

DDS (Ver_11-03-05.01) - NTFS_AMD64
Run by Tgon at 9:35:02.97 on 10/03/2011
Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_23
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.44.1033.18.4092.2297 [GMT 0:00]
.
AV: avast! Antivirus *Enabled/Updated* {C37D8F93-0602-E43C-40AA-47DAD597F308}
SP: avast! Antivirus *Enabled/Updated* {781C6E77-2038-EBB2-7A1A-7CA8AE10B9B5}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_70dacb64382a61a7\STacSV64.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\Hpservice.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\Windows\system32\WLANExt.exe
C:\Windows\system32\conhost.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_70dacb64382a61a7\AESTSr64.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files (x86)\Bonjour\mDNSResponder.exe
C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
C:\Windows\system32\lxcecoms.exe
C:\Program Files (x86)\DAODB\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Windows\System32\alg.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\atieclxx.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\IDT\WDM\sttray64.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files (x86)\Hp\HP Software Update\hpwuschd2.exe
C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
C:\Program Files\Logitech\SetPoint\x86\SetPoint32.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac
C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
C:\Program Files (x86)\Hewlett-Packard\Shared\hpqToaster.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files (x86)\Hewlett-Packard\Shared\hpCaslNotification.exe
C:\Windows\system32\taskeng.exe
c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe
C:\Windows\system32\DllHost.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
C:\Windows\system32\notepad.exe
C:\Windows\SysWOW64\NOTEPAD.EXE
C:\Program Files (x86)\VideoLAN\VLC\vlc.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Users\Tgon\Downloads\dds.scr
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2269050
uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: DVDVideoSoftTB Toolbar: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\tbDVDV.dll
mURLSearchHooks: DVDVideoSoftTB Toolbar: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\tbDVDV.dll
mWinlogon: Userinit=c:\windows\syswow64\userinit.exe,
BHO: IEPlugin Class: {11222041-111b-46e3-bd29-efb2449479b1} - C:\PROGRA~2\ArcSoft\MEDIAC~1\INTERN~1\ARCURL~1.DLL
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
BHO: DVDVideoSoftTB Toolbar: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\tbDVDV.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Windows Live Messenger Companion Helper: {9fdde16b-836f-4806-ab1f-1455cbeff289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
BHO: Bing Bar BHO: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB: @C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll,-100: {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll
TB: DVDVideoSoftTB Toolbar: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\tbDVDV.dll
TB: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
TB: {32099AAC-C132-4136-9E9A-4E364A424E17} - No File
mRun: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
mRun: [HPCam_Menu] "c:\Program Files (x86)\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe" "c:\Program Files (x86)\Hewlett-Packard\Media\Webcam" UpdateWithCreateOnce "Software\Hewlett-Packard\Media\Webcam"
mRun: [QlbCtrl.exe] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
mRun: [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe
mRun: [WirelessAssistant] C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
mRun: [ArcSoft Connection Service] C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRunOnce: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
StartupFolder: C:\Users\Tgon\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\AVAST!~1.LNK - C:\Program Files\Alwil Software\Avast5\AvastUI.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\BLUETO~1.LNK - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\LOGITE~1.LNK - C:\Program Files\Logitech\SetPoint\SetPoint.exe
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
mPolicies-system: HideFastUserSwitching = 0 (0x0)
IE: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~3\Office14\EXCEL.EXE/3000
IE: Free YouTube to iPod Converter - C:\Users\Tgon\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetoipodconverter.htm
IE: Send image to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files (x86)\Common Files\LightScribe\LSRunOnce.exe"
BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO-X64: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
TB-X64: {32099AAC-C132-4136-9E9A-4E364A424E17} - No File
TB-X64: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
mRun-x64: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
mRun-x64: [SmartMenu] C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe /background
mRun-x64: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
mRun-x64: [SysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe
mRun-x64: [LXCECATS] rundll32 C:\Windows\system32\spool\DRIVERS\x64\3\LXCEtime.dll,RunDLLEntry
IE-X64: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Tgon\AppData\Roaming\Mozilla\Firefox\Profiles\stbp5q24.default\
FF - component: C:\Program Files (x86)\ArcSoft\Media Converter for Philips\Internet Video Downloader\Plugin_FireFox\components\nsURLRecordEx.dll
FF - component: C:\Users\Tgon\AppData\Roaming\Mozilla\Firefox\Profiles\stbp5q24.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\components\FFExternalAlert.dll
FF - component: C:\Users\Tgon\AppData\Roaming\Mozilla\Firefox\Profiles\stbp5q24.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\components\RadioWMPCore.dll
FF - plugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: C:\Program Files (x86)\Google\Update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll
FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - C:\Program Files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
FF - Ext: Internet Video Downloader: {B728AB94-9BC7-49b7-B76A-422BB31B2FD0} - C:\Program Files (x86)\ArcSoft\Media Converter for Philips\Internet Video Downloader\Plugin_FireFox
FF - Ext: DVDVideoSoft Menu: {ACAA314B-EEBA-48e4-AD47-84E31C44796C} - %profile%\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
FF - Ext: Xmarks: foxmarks@kei.com - %profile%\extensions\foxmarks@kei.com
FF - Ext: DVDVideoSoftTB Toolbar: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - %profile%\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}
.
============= SERVICES / DRIVERS ===============
.
R1 aswSP;aswSP;C:\Windows\System32\drivers\aswSP.sys [2010-12-4 273488]
R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\System32\drivers\vwififlt.sys [2009-7-14 59904]
R2 AESTFilters;Andrea ST Filters Service;C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_70dacb64382a61a7\AESTSr64.exe [2011-1-24 89600]
R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2009-8-5 203264]
R2 aswFsBlk;aswFsBlk;C:\Windows\System32\drivers\aswFsBlk.sys [2010-12-4 20560]
R2 aswMonFlt;aswMonFlt;C:\Windows\System32\drivers\aswMonFlt.sys [2010-12-4 62032]
R2 avast! Antivirus;avast! Antivirus;C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2011-1-15 40384]
R2 ezSharedSvc;Easybits Shared Services for Windows;C:\Windows\system32\svchost.exe -k netsvcs [2009-7-13 27136]
R2 HPDrvMntSvc.exe;HP Quick Synchronization Service;C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2010-10-14 92216]
R2 hpsrv;HP Service;C:\Windows\System32\hpservice.exe [2010-7-16 30520]
R2 MSSQL$BWDATOOLSET;SQL Server (BWDATOOLSET);C:\Program Files (x86)\DAODB\MSSQL.1\MSSQL\Binn\sqlservr.exe [2009-5-27 29262680]
R2 SBSDWSCService;SBSD Security Center Service;C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2011-1-1 1153368]
R3 btusbflt;Bluetooth USB Filter;C:\Windows\System32\drivers\btusbflt.sys [2010-4-14 54824]
R3 btwl2cap;Bluetooth L2CAP Service;C:\Windows\System32\drivers\btwl2cap.sys [2010-1-10 35104]
R3 Com4QLBEx;Com4QLBEx;C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2009-10-31 227896]
R3 enecir;ENE CIR Receiver;C:\Windows\System32\drivers\enecir.sys [2009-6-29 70656]
R3 LVUSBS64;Logitech USB Monitor Filter;C:\Windows\System32\drivers\LVUSBS64.sys [2008-7-26 50072]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2010-1-10 215040]
R3 usbfilter;AMD USB Filter Driver;C:\Windows\System32\drivers\usbfilter.sys [2010-1-10 36408]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\Windows\System32\drivers\vwifimp.sys [2009-7-14 17920]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-4-6 136176]
S3 fssfltr;fssfltr;C:\Windows\System32\drivers\fssfltr.sys [2010-12-4 48488]
S3 fsssvc;Windows Live Family Safety Service;C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2010-9-23 1493352]
S3 JMCR;JMCR;C:\Windows\System32\drivers\jmcr.sys [2009-7-21 140712]
S3 lvpepf64;Volume Adapter;C:\Windows\System32\drivers\lv302a64.sys [2008-7-26 15768]
S3 LVRS64;Logitech RightSound Filter Driver;C:\Windows\System32\drivers\lvrs64.sys [2008-7-26 790424]
S3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;C:\Windows\System32\drivers\netw5v64.sys [2009-6-10 5434368]
S3 SrvHsfHDA;SrvHsfHDA;C:\Windows\System32\drivers\VSTAZL6.SYS [2009-7-13 292864]
S3 SrvHsfV92;SrvHsfV92;C:\Windows\System32\drivers\VSTDPV6.SYS [2009-7-13 1485312]
S3 SrvHsfWinac;SrvHsfWinac;C:\Windows\System32\drivers\VSTCNXT6.SYS [2009-7-13 740864]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2010-12-14 51712]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2010-6-25 1255736]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\System32\drivers\yk62x64.sys [2009-6-10 389120]
S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]
.
=============== Created Last 30 ================
.
2011-03-10 08:54:31 -------- d-----w- C:\Users\Tgon\AppData\Roaming\Malwarebytes
2011-03-10 08:54:25 38224 ----a-w- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
2011-03-10 08:54:25 -------- d-----w- C:\PROGRA~3\Malwarebytes
2011-03-10 08:54:22 24152 ----a-w- C:\Windows\System32\drivers\mbam.sys
2011-03-10 08:54:21 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2011-03-08 06:01:34 7947600 ----a-w- C:\PROGRA~3\Microsoft\Windows Defender\Definition Updates\{25A552CC-B9A4-4CE0-994C-E1FD48F2FD81}\mpengine.dll
2011-02-28 21:37:39 -------- d-----w- C:\Users\Tgon\Edits
2011-02-28 08:29:58 -------- d-----w- C:\Windows\pss
2011-02-26 21:36:08 987136 ----a-w- C:\Windows\SysWow64\NCTVideoCoreM.dll
2011-02-26 21:36:08 90112 ----a-w- C:\Windows\SysWow64\NCTAudioFormatSettings3.dll
2011-02-26 21:36:08 348160 ----a-w- C:\Windows\SysWow64\NCTWMAFile2.dll
2011-02-26 21:36:08 290816 ----a-w- C:\Windows\SysWow64\NCTAVIFile.dll
2011-02-26 21:36:08 2469888 ----a-w- C:\Windows\SysWow64\NCTAudioCompress3.dll
2011-02-26 21:36:08 2183168 ----a-w- C:\Windows\SysWow64\NCTVideoCompress.dll
2011-02-26 21:36:08 196608 ----a-w- C:\Windows\SysWow64\NCTWMVFile.dll
2011-02-26 21:36:08 1810432 ----a-w- C:\Windows\SysWow64\NCTAudioCompress2.dll
2011-02-26 21:36:08 139264 ----a-w- C:\Windows\SysWow64\NCTVideoFile.dll
2011-02-26 21:36:08 -------- d-----w- C:\Program Files (x86)\Free WMV to AVI MPEG Converter
2011-02-26 21:09:54 -------- d-----w- C:\Users\Tgon\AppData\Roaming\BBCiPlayerDesktop.61DB7A798358575D6A969CCD73DDBBD723A6DA9D.1
2011-02-26 21:09:50 -------- d-----w- C:\Program Files (x86)\BBC iPlayer Desktop
2011-02-24 03:00:47 367104 ----a-w- C:\Windows\System32\wcncsvc.dll
2011-02-24 03:00:47 276992 ----a-w- C:\Windows\SysWow64\wcncsvc.dll
2011-02-23 03:19:53 442880 ----a-w- C:\Windows\SysWow64\XpsPrint.dll
2011-02-23 03:19:52 662528 ----a-w- C:\Windows\System32\XpsPrint.dll
2011-02-23 03:19:52 475648 ----a-w- C:\Windows\System32\XpsGdiConverter.dll
2011-02-23 03:19:52 288256 ----a-w- C:\Windows\SysWow64\XpsGdiConverter.dll
2011-02-21 20:33:32 -------- d-----w- C:\Program Files (x86)\Convert AVI to MP4
2011-02-21 20:24:51 -------- d-----w- C:\Users\Tgon\ipa
2011-02-20 22:21:27 -------- d-----w- C:\Program Files (x86)\Conduit
2011-02-20 22:21:26 -------- d-----w- C:\Program Files (x86)\DVDVideoSoftTB
2011-02-18 09:23:21 -------- d-----w- C:\Users\Tgon\AppData\Local\PCSX2
2011-02-17 23:40:50 34152 ----a-w- C:\Windows\System32\drivers\GEARAspiWDM.sys
2011-02-17 23:40:50 126312 ----a-w- C:\Windows\System32\GEARAspi64.dll
2011-02-17 23:40:50 107368 ----a-w- C:\Windows\SysWow64\GEARAspi.dll
2011-02-17 23:40:24 -------- d-----w- C:\Program Files\iPod
2011-02-17 23:40:18 -------- d-----w- C:\Program Files\iTunes
2011-02-17 23:40:18 -------- d-----w- C:\Program Files (x86)\iTunes
2011-02-17 23:40:18 -------- d-----w- C:\PROGRA~3\{93E26451-CD9A-43A5-A2FA-C42392EA4001}
2011-02-17 22:33:30 -------- d-----w- C:\Program Files\Bonjour
2011-02-17 22:33:30 -------- d-----w- C:\Program Files (x86)\Bonjour
2011-02-13 23:35:17 -------- d-----w- C:\Program Files\Lx_cats
2011-02-13 23:35:10 145920 ----a-w- C:\Windows\System32\Spool\prtprocs\x64\lxcepp6c.dll
2011-02-13 23:33:43 -------- d-----w- C:\drivers
2011-02-09 05:37:58 3127808 ----a-w- C:\Windows\System32\win32k.sys
2011-02-08 23:59:19 -------- d-----w- C:\Users\Tgon\Recordings
2011-02-08 22:18:12 -------- d-----w- C:\Users\Tgon\Images
2011-02-08 22:17:48 -------- d-----w- C:\Users\Tgon\Audio
.
==================== Find3M ====================
.
2011-02-19 06:37:44 1135104 ----a-w- C:\Windows\System32\FntCache.dll
2011-02-19 06:37:10 1540608 ----a-w- C:\Windows\System32\DWrite.dll
2011-02-19 06:36:49 902656 ----a-w- C:\Windows\System32\d2d1.dll
2011-02-19 05:32:48 1074176 ----a-w- C:\Windows\SysWow64\DWrite.dll
2011-02-19 05:32:35 739840 ----a-w- C:\Windows\SysWow64\d2d1.dll
2011-02-10 08:20:32 472808 ----a-w- C:\Windows\SysWow64\deployJava1.dll
2011-02-02 17:11:20 270720 ------w- C:\Windows\System32\MpSigStub.exe
2011-01-26 06:53:10 982912 ----a-w- C:\Windows\System32\drivers\dxgkrnl.sys
2011-01-26 06:53:10 265088 ----a-w- C:\Windows\System32\drivers\dxgmms1.sys
2011-01-26 06:31:20 144384 ----a-w- C:\Windows\System32\cdd.dll
2011-01-24 12:50:09 90624 ----a-w- C:\Windows\System32\AESTCo64.dll
2011-01-24 12:50:09 68608 ----a-w- C:\Windows\System32\AESTAR64.dll
2011-01-24 12:50:09 645632 ------w- C:\Windows\System32\stapi64.dll
2011-01-24 12:50:09 564224 ----a-w- C:\Windows\System32\idt64mp1.exe
2011-01-24 12:50:09 487424 ----a-w- C:\Windows\sttray64.exe
2011-01-24 12:50:09 442368 ----a-w- C:\Windows\System32\AESTEC64.dll
2011-01-24 12:50:09 431616 ----a-w- C:\Windows\System32\stcplx64.dll
2011-01-24 12:50:09 3348480 ----a-w- C:\Windows\System32\stlang64.dll
2011-01-24 12:50:09 209920 ----a-w- C:\Windows\System32\staco64.dll
2011-01-24 12:50:09 162304 ----a-w- C:\Windows\System32\AESTAC64.dll
2011-01-24 12:50:09 1465344 ----a-w- C:\Windows\System32\stapo64.dll
2011-01-24 12:50:09 12772352 ----a-w- C:\Windows\System32\idtcpl64.cpl
2011-01-13 08:37:23 62032 ----a-w- C:\Windows\System32\drivers\aswMonFlt.sys
2011-01-07 08:06:50 46080 ----a-w- C:\Windows\System32\atmlib.dll
2011-01-07 07:27:11 34304 ----a-w- C:\Windows\SysWow64\atmlib.dll
2011-01-07 05:49:20 366080 ----a-w- C:\Windows\System32\atmfd.dll
2011-01-07 05:33:11 294400 ----a-w- C:\Windows\SysWow64\atmfd.dll
2011-01-05 21:51:44 232501 ----a-w- C:\Users\Tgon\AppData\Roaming\Minecraft.exe
2011-01-05 06:20:30 612352 ----a-w- C:\Windows\System32\vbscript.dll
2011-01-05 05:37:33 428032 ----a-w- C:\Windows\SysWow64\vbscript.dll
2011-01-02 14:27:21 93671 ----a-w- C:\Users\Tgon\AppData\Roaming\Uninstal.exe
2010-12-31 20:06:36 38848 ----a-w- C:\Windows\avastSS.scr
2010-12-23 06:07:50 1118720 ----a-w- C:\Windows\System32\sbe.dll
2010-12-23 06:07:49 961024 ----a-w- C:\Windows\System32\CPFilters.dll
2010-12-23 06:07:49 723968 ----a-w- C:\Windows\System32\EncDec.dll
2010-12-23 06:02:33 259072 ----a-w- C:\Windows\System32\mpg2splt.ax
2010-12-23 05:28:29 850432 ----a-w- C:\Windows\SysWow64\sbe.dll
2010-12-23 05:28:28 642048 ----a-w- C:\Windows\SysWow64\CPFilters.dll
2010-12-23 05:28:28 534528 ----a-w- C:\Windows\SysWow64\EncDec.dll
2010-12-23 05:24:02 199680 ----a-w- C:\Windows\SysWow64\mpg2splt.ax
2010-12-21 06:16:27 97280 ----a-w- C:\Windows\System32\wscsvc.dll
2010-12-21 06:16:27 62976 ----a-w- C:\Windows\System32\wscapi.dll
2010-12-21 06:16:16 214016 ----a-w- C:\Windows\System32\winsrv.dll
2010-12-21 06:16:14 442880 ----a-w- C:\Windows\System32\winhttp.dll
2010-12-21 06:16:14 1197056 ----a-w- C:\Windows\System32\wininet.dll
2010-12-21 06:16:09 258048 ----a-w- C:\Windows\System32\WebClnt.dll
2010-12-21 06:15:55 264192 ----a-w- C:\Windows\System32\upnp.dll
2010-12-21 06:15:31 15360 ----a-w- C:\Windows\System32\slwga.dll
2010-12-21 06:13:03 2003968 ----a-w- C:\Windows\System32\msxml6.dll
2010-12-21 06:13:03 1880576 ----a-w- C:\Windows\System32\msxml3.dll
2010-12-21 06:10:22 100864 ----a-w- C:\Windows\System32\davclnt.dll
2010-12-21 05:38:24 51200 ----a-w- C:\Windows\SysWow64\wscapi.dll
2010-12-21 05:38:22 981504 ----a-w- C:\Windows\SysWow64\wininet.dll
2010-12-21 05:38:22 350720 ----a-w- C:\Windows\SysWow64\winhttp.dll
2010-12-21 05:38:21 204800 ----a-w- C:\Windows\SysWow64\WebClnt.dll
2010-12-21 05:38:19 204288 ----a-w- C:\Windows\SysWow64\upnp.dll
2010-12-21 05:38:16 14336 ----a-w- C:\Windows\SysWow64\slwga.dll
2010-12-21 05:36:17 1389568 ----a-w- C:\Windows\SysWow64\msxml6.dll
2010-12-21 05:36:16 1236992 ----a-w- C:\Windows\SysWow64\msxml3.dll
2010-12-21 05:34:12 80384 ----a-w- C:\Windows\SysWow64\davclnt.dll
2010-12-18 06:12:28 3138048 ----a-w- C:\Windows\System32\mstscax.dll
2010-12-18 06:11:41 57856 ----a-w- C:\Windows\System32\licmgr10.dll
2010-12-18 06:11:34 714752 ----a-w- C:\Windows\System32\kerberos.dll
2010-12-18 06:08:15 1097216 ----a-w- C:\Windows\System32\mstsc.exe
2010-12-18 05:30:20 2690560 ----a-w- C:\Windows\SysWow64\mstscax.dll
2010-12-18 05:29:40 44544 ----a-w- C:\Windows\SysWow64\licmgr10.dll
2010-12-18 05:29:31 541184 ----a-w- C:\Windows\SysWow64\kerberos.dll
2010-12-18 05:26:55 1034240 ----a-w- C:\Windows\SysWow64\mstsc.exe
2010-12-18 04:55:03 482816 ----a-w- C:\Windows\System32\html.iec
2010-12-18 04:20:55 386048 ----a-w- C:\Windows\SysWow64\html.iec
2010-12-18 04:13:40 1638912 ----a-w- C:\Windows\System32\mshtml.tlb
2010-12-18 03:47:59 1638912 ----a-w- C:\Windows\SysWow64\mshtml.tlb
2010-12-14 18:51:20 51712 ----a-w- C:\Windows\System32\drivers\usbaapl64.sys
2010-12-14 18:51:20 4184352 ----a-w- C:\Windows\System32\usbaaplrc.dll
.
============= FINISH: 9:35:58.67 ===============

Attach -

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_11-03-05.01)
.
Microsoft Windows 7 Home Premium
Boot Device: \Device\HarddiskVolume1
Install Date: 28/02/2010 15:21:21
System Uptime: 10/03/2011 08:25:44 (1 hours ago)
.
Motherboard: Hewlett-Packard | | 3636
Processor: AMD Turion(tm) II Ultra Dual-Core Mobile M620 | Socket S1G3 | 2500/200mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 452 GiB total, 197.65 GiB free.
D: is FIXED (NTFS) - 14 GiB total, 2.244 GiB free.
E: is FIXED (FAT32) - 0 GiB total, 0.094 GiB free.
F: is CDROM ()
H: is CDROM ()
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP242: 04/03/2011 02:21:16 - Scheduled Checkpoint
RP243: 04/03/2011 06:01:13 - Windows Update
RP244: 08/03/2011 06:01:09 - Windows Update
RP245: 10/03/2011 03:00:11 - Windows Update
.
==== Installed Programs ======================
.
ActiveCheck component for HP Active Support Library
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 9.4.2 MUI
Adobe Shockwave Player
AMD USB Filter Driver
Apple Application Support
Apple Software Update
Atheros Driver Installation Program
µTorrent
avast! Free Antivirus
AVS Update Manager 1.0
AVS Video Editor 4 4.2.1.166
AVS Video Recorder 2.4 (Service Version)
AVS YouTube Uploader version 2.1
AVS4YOU Software Navigator 1.3
BBC iPlayer Desktop
Bing Bar Platform
Catalyst Control Center - Branding
Catalyst Control Center Core Implementation
Catalyst Control Center Graphics Full Existing
Catalyst Control Center Graphics Full New
Catalyst Control Center Graphics Light
Catalyst Control Center Graphics Previews Common
Catalyst Control Center Graphics Previews Vista
Catalyst Control Center InstallProxy
Catalyst Control Center Localization All
ccc-core-static
CCC Help Chinese Standard
CCC Help Chinese Traditional
CCC Help Czech
CCC Help Danish
CCC Help Dutch
CCC Help English
CCC Help Finnish
CCC Help French
CCC Help German
CCC Help Greek
CCC Help Hungarian
CCC Help Italian
CCC Help Japanese
CCC Help Korean
CCC Help Norwegian
CCC Help Polish
CCC Help Portuguese
CCC Help Russian
CCC Help Spanish
CCC Help Swedish
CCC Help Thai
CCC Help Turkish
Cisco EAP-FAST Module
Cisco LEAP Module
Cisco PEAP Module
Convert AVI to MP4 1.3
CyberLink DVD Suite
D3DX10
DAEMON Tools Lite
DVD Menu Pack for HP MediaSmart Video
DVDVideoSoftTB Toolbar
erLT
FileZilla Client 3.3.5.1
Fraps (remove only)
Free WMV to AVI MPEG Converter v1.2
Free YouTube to iPod Converter version 3.9.28
FreeRIP v3.5
GDR 4053 for SQL Server Database Services 2005 ENU (KB970892)
GDR 4053 for SQL Server Tools and Workstation Components 2005 ENU (KB970892)
GoGear SA1VBExxA Device Manager
Google Chrome
Google Earth
Google Update Helper
HP Customer Experience Enhancements
HP Games
HP MediaSmart DVD
HP MediaSmart Internet TV
HP MediaSmart Live TV
HP MediaSmart Music/Photo/Video
HP MediaSmart Software Notebook Demo
HP MediaSmart Webcam
HP Quick Launch Buttons
HP Setup
HP Support Assistant
HP Update
HP User Guides 0154
HP Wireless Assistant
HPAsset component for HP Active Support Library
IDT Audio
Java Auto Updater
Java(TM) 6 Update 23
Junk Mail filter update
LabelPrint
LightScribe System Software
Logitech SetPoint
Malwarebytes' Anti-Malware
Media Converter for Philips
Mesh Runtime
Messenger Companion
Microsoft .NET Framework 1.1
Microsoft Search Enhancement Pack
Microsoft Silverlight
Microsoft SQL Server 2005
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft SQL Server 2005 Express Edition (BWDATOOLSET)
Microsoft SQL Server 2005 Tools Express Edition
Microsoft SQL Server Setup Support Files (English)
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
mIRC
Movie Theme Pack for HP MediaSmart Video
Mozilla Firefox (3.6.15)
MSVCRT
MSVCRT_amd64
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Neverwinter Nights 2
NVIDIA PhysX
OpenOffice.org 3.2
Pando Media Booster
Power2Go
PowerDirector
QLBCASL
Quick Web Player
QuickTime
Realtek 8136 8168 8169 Ethernet Driver
Recovery Manager
Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841)
Skype™ 5.1
SPORE™
Spybot - Search & Destroy
Steinberg Cubase 5
Steinberg Drum Loop Expansion 01
Steinberg Groove Agent ONE Content
Steinberg HALionOne
Steinberg HALionOne Additional Content Set 01
Steinberg HALionOne Expression Set
Steinberg HALionOne GM Drum Set
Steinberg HALionOne GM Set
Steinberg HALionOne Pro Set
Steinberg HALionOne Studio Drum Set
Steinberg HALionOne Studio Set
Steinberg LoopMash Content
Steinberg REVerence Content 01
The Lord of the Rings Online™ v03.02.04.8010
Tropico 3 1.00
Visual C++ 8.0 Runtime Setup Package (x64)
Visual Studio 2008 x64 Redistributables
VLC media player 1.1.7
Windows Live Communications Platform
Windows Live Essentials
Windows Live Installer
Windows Live Mail
Windows Live Mesh
Windows Live Mesh ActiveX Control for Remote Connections
Windows Live Messenger
Windows Live Messenger Companion Core
Windows Live Movie Maker
Windows Live Photo Common
Windows Live Photo Gallery
Windows Live PIMT Platform
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live Sync
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
WinRAR archiver
.
==== Event Viewer Messages From Past Week ========
.
10/03/2011 08:26:06, Error: atikmdag [52236] - CPLIB :: General - Invalid Parameter
10/03/2011 08:25:59, Error: volmgr [46] - Crash dump initialization failed!
10/03/2011 03:19:34, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Winmgmt service.
10/03/2011 03:18:48, Error: Microsoft-Windows-WLAN-AutoConfig [10003] - WLAN Extensibility Module has stopped unexpectedly. Module Path: C:\Windows\system32\athihvs.dll
07/03/2011 13:24:46, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Error Reporting Service service to connect.
05/03/2011 19:49:21, Error: Microsoft-Windows-SharedAccess_NAT [34001] - The ICS_IPV6 failed to configure IPv6 stack.
05/03/2011 09:54:38, Error: NetBT [4319] - A duplicate name has been detected on the TCP network. The IP address of the computer that sent the message is in the data. Use nbtstat -n in a command window to see which name is in the Conflict state.
03/03/2011 18:56:39, Error: volsnap [36] - The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit.
.
==== End Of File ===========================

4
Contributors
5
Replies
7
Views
6 Years
Discussion Span
Last Post by jholland1964
1

Hi and welcome to the Daniweb forums :).

==========

Please read carefully and follow these steps.

  • Download TDSSKiller and save it to your Desktop.
  • Extract its contents to your desktop.
  • Once extracted, open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
  • If an infected file is detected, the default action will be Cure, click on Continue.
  • If a suspicious file is detected, the default action will be Skip, click on Continue.
  • It may ask you to reboot the computer to complete the process. Click on Reboot Now.
  • If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
  • If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.

==================

Please download NTBR by noahdfear and save it to your Desktop.
File size: 2.44 MB (2,565,432 bytes)

  • Place a blank CD in your CD drive.
  • Double click on NTBR_CD.exe file and a folder of the same name will appear.
  • Open the folder and double click on BurnItCD.cmd file. If your CD drive will open, simply close it back.
  • Follow the prompts to burn the CD.
  • Now you will need to set the CD-Rom as first boot device if it isn't already (if you don't know how to do it, see (HERE)
  • If you have any questions about this step, ask before you proceed. If you enter the BIOS and are unsure if you have carried out the step correctly, there should be an option to exit without keeping changes, so you won't do any harm.
  • Insert the newly created CD into your infected PC and reboot your computer.
  • Once you have rebooted please press Enter when prompted to continue booting from CD - you have a whole 15 seconds to do this!
  • Read the warning and then continue as prompted.
  • You first need to select your keyboard layout - press Enter for English.
  • Next you want to select the appropriate tool. Enter 1 to choose 1. MBRWORK
  • On the following screen enter 5 to select Install Standard MBR code.
  • Enter 1 to overwrite the infected MBR Code with the Standard MBR code.
  • When asked to confirm please do so.
  • Afterwards, please enter E to leave MBRWORK, then 6 to leave the bootable CD.
  • Eject the disc and then press ctrl+alt+del to reboot the PC.

Once rebooted, download MBRCheck to your desktop

Double click MBRCheck.exe to run (Vista and Windows 7 users, right click and select Run as Administrator).
It will show a black screen with some data on it.
A report called MBRcheckxxxx.txt will be on your desktop
Open this report and post its content in your next reply..

0

Download TDSSKiller

This seems to have cleared it.

Thanks {:0)

Edited by Tgon: n/a

0

No worries :)

HI Crunchie, i have the same problem as TGON, i have run all the checks you listed i.e

run tdsskiller

run the NTBR_CD and have run the MBR.exe which i will attach to this post.

but my hard drive space keeps going down 1mb every 30mins - 1hr is frustrating as all my a.v's say there is no threat.

can u help??

Attachments
MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:			
Windows Version:		Windows XP Home Edition
Windows Information:		Service Pack 2 (build 2600)
Logical Drives Mask:		0x0000001c

Kernel Drivers (total 128):
  0x804D7000 \WINDOWS\system32\ntkrnlpa.exe
  0x806CE000 \WINDOWS\system32\hal.dll
  0xBA5A8000 \WINDOWS\system32\KDCOM.DLL
  0xBA4B8000 \WINDOWS\system32\BOOTVID.dll
  0xB9F79000 ACPI.sys
  0xBA5AA000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
  0xB9F68000 pci.sys
  0xBA0A8000 isapnp.sys
  0xBA0B8000 ohci1394.sys
  0xBA0C8000 \WINDOWS\system32\DRIVERS\1394BUS.SYS
  0xBA4BC000 compbatt.sys
  0xBA4C0000 \WINDOWS\system32\DRIVERS\BATTC.SYS
  0xBA670000 pciide.sys
  0xBA328000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
  0xBA5AC000 intelide.sys
  0xB9F4A000 pcmcia.sys
  0xBA0D8000 MountMgr.sys
  0xB9F2B000 ftdisk.sys
  0xBA4C4000 ACPIEC.sys
  0xBA671000 \WINDOWS\system32\DRIVERS\OPRGHDLR.SYS
  0xBA330000 PartMgr.sys
  0xBA0E8000 VolSnap.sys
  0xB9F13000 atapi.sys
  0xBA0F8000 disk.sys
  0xBA108000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
  0xB9EF4000 fltMgr.sys
  0xB9EE2000 sr.sys
  0xB9EBF000 Fastfat.sys
  0xB9EA8000 KSecDD.sys
  0xB9E7B000 NDIS.sys
  0xB9E60000 Mup.sys
  0xBA138000 \SystemRoot\system32\DRIVERS\intelppm.sys
  0xB9DA7000 \SystemRoot\system32\DRIVERS\ialmnt5.sys
  0xB9D93000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
  0xBA350000 \SystemRoot\system32\DRIVERS\usbuhci.sys
  0xB9D70000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
  0xBA358000 \SystemRoot\system32\DRIVERS\usbehci.sys
  0xB9D5E000 \SystemRoot\system32\DRIVERS\Rtlnicxp.sys
  0xB9CFF000 \SystemRoot\system32\DRIVERS\tnet1130x.sys
  0xBA148000 \SystemRoot\system32\DRIVERS\i8042prt.sys
  0xBA360000 \SystemRoot\system32\DRIVERS\DKbFltr.sys
  0xBA368000 \SystemRoot\system32\DRIVERS\kbdclass.sys
  0xB9CD1000 \SystemRoot\system32\DRIVERS\SynTP.sys
  0xBA5AE000 \SystemRoot\system32\DRIVERS\USBD.SYS
  0xBA370000 \SystemRoot\system32\DRIVERS\mouclass.sys
  0xBA53C000 \SystemRoot\system32\DRIVERS\CmBatt.sys
  0xBA158000 \SystemRoot\system32\DRIVERS\imapi.sys
  0xBA168000 \SystemRoot\system32\DRIVERS\cdrom.sys
  0xBA178000 \SystemRoot\system32\DRIVERS\redbook.sys
  0xB9CAE000 \SystemRoot\system32\DRIVERS\ks.sys
  0xBA5B0000 \SystemRoot\system32\DRIVERS\NTIDrvr.sys
  0xB9C15000 \SystemRoot\system32\drivers\ALCXWDM.SYS
  0xB9BF1000 \SystemRoot\system32\drivers\portcls.sys
  0xBA188000 \SystemRoot\system32\drivers\drmk.sys
  0xB9B8F000 \SystemRoot\system32\drivers\ALCXSENS.SYS
  0xB9A59000 \SystemRoot\system32\DRIVERS\AGRSM.sys
  0xBA378000 \SystemRoot\System32\Drivers\Modem.SYS
  0xBA708000 \SystemRoot\system32\DRIVERS\audstub.sys
  0xBA380000 \SystemRoot\system32\DRIVERS\rasirda.sys
  0xBA388000 \SystemRoot\system32\DRIVERS\TDI.SYS
  0xBA198000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
  0xBA550000 \SystemRoot\system32\DRIVERS\ndistapi.sys
  0xB9A42000 \SystemRoot\system32\DRIVERS\ndiswan.sys
  0xBA1A8000 \SystemRoot\system32\DRIVERS\raspppoe.sys
  0xBA1B8000 \SystemRoot\system32\DRIVERS\raspptp.sys
  0xB9A31000 \SystemRoot\system32\DRIVERS\psched.sys
  0xBA1C8000 \SystemRoot\system32\DRIVERS\msgpc.sys
  0xBA390000 \SystemRoot\system32\DRIVERS\ptilink.sys
  0xBA398000 \SystemRoot\system32\DRIVERS\raspti.sys
  0xBA1D8000 \SystemRoot\system32\DRIVERS\termdd.sys
  0xBA5B2000 \SystemRoot\system32\DRIVERS\swenum.sys
  0xB99D5000 \SystemRoot\system32\DRIVERS\update.sys
  0xBA55C000 \SystemRoot\system32\DRIVERS\mssmbios.sys
  0xBA1F8000 \SystemRoot\System32\Drivers\NDProxy.SYS
  0xB189C000 \SystemRoot\system32\drivers\ialmkchw.sys
  0xB187E000 \SystemRoot\system32\drivers\ialmsbw.sys
  0xBA218000 \SystemRoot\system32\DRIVERS\usbhub.sys
  0xBA5B6000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
  0xB9DEF000 \SystemRoot\System32\Drivers\Null.SYS
  0xBA5B8000 \SystemRoot\System32\Drivers\Beep.SYS
  0xBA3B8000 \SystemRoot\System32\drivers\vga.sys
  0xBA5BA000 \SystemRoot\System32\Drivers\mnmdd.SYS
  0xBA5BC000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
  0xBA3C0000 \SystemRoot\System32\Drivers\Msfs.SYS
  0xBA3C8000 \SystemRoot\System32\Drivers\Npfs.SYS
  0xBA584000 \SystemRoot\system32\DRIVERS\rasacd.sys
  0xB182B000 \SystemRoot\system32\DRIVERS\ipsec.sys
  0xB17D3000 \SystemRoot\system32\DRIVERS\tcpip.sys
  0xBA228000 \SystemRoot\System32\Drivers\aswTdi.SYS
  0xB1783000 \SystemRoot\system32\DRIVERS\netbt.sys
  0xBA3D0000 \SystemRoot\System32\Drivers\aswRdr.SYS
  0xB1761000 \SystemRoot\System32\drivers\afd.sys
  0xBA238000 \SystemRoot\system32\DRIVERS\netbios.sys
  0xB1735000 \SystemRoot\system32\DRIVERS\rdbss.sys
  0xB16C6000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
  0xBA248000 \SystemRoot\System32\Drivers\Fips.SYS
  0xB16A5000 \SystemRoot\system32\DRIVERS\ipnat.sys
  0xBA258000 \SystemRoot\system32\DRIVERS\wanarp.sys
  0xB165D000 \SystemRoot\System32\Drivers\aswSP.SYS
  0xB15FF000 \SystemRoot\System32\Drivers\aswSnx.SYS
  0xBA3E0000 \SystemRoot\System32\Drivers\Aavmker4.SYS
  0xB15B1000 \SystemRoot\system32\Drivers\rdwm1046.sys
  0xBA278000 \SystemRoot\System32\Drivers\Cdfs.SYS
  0xB1599000 \SystemRoot\System32\Drivers\dump_atapi.sys
  0xBA5BE000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
  0xBF800000 \SystemRoot\System32\win32k.sys
  0xB9A1D000 \SystemRoot\System32\drivers\Dxapi.sys
  0xBA3E8000 \SystemRoot\System32\watchdog.sys
  0xBF000000 \SystemRoot\System32\drivers\dxg.sys
  0xBA73E000 \SystemRoot\System32\drivers\dxgthk.sys
  0xBF020000 \SystemRoot\System32\ialmdnt5.dll
  0xBF012000 \SystemRoot\System32\ialmrnt5.dll
  0xBF042000 \SystemRoot\System32\ialmdev5.DLL
  0xBF073000 \SystemRoot\System32\ialmdd5.DLL
  0xB1585000 \SystemRoot\System32\Drivers\aswFsBlk.SYS
  0xB13F3000 \SystemRoot\system32\DRIVERS\irda.sys
  0xB1495000 \SystemRoot\system32\DRIVERS\ndisuio.sys
  0xB11FC000 \SystemRoot\System32\Drivers\aswMon2.SYS
  0xB0F67000 \SystemRoot\system32\drivers\wdmaud.sys
  0xB1273000 \SystemRoot\system32\drivers\sysaudio.sys
  0xB0C65000 \SystemRoot\system32\DRIVERS\mrxdav.sys
  0xBA74F000 \??\C:\WINDOWS\system32\drivers\epm-psd.sys
  0xB0C29000 \??\C:\WINDOWS\system32\drivers\epm-shd.sys
  0xB0A92000 \SystemRoot\system32\DRIVERS\srv.sys
  0xB0619000 \SystemRoot\System32\Drivers\HTTP.sys
  0xB05EF000 
  0xBA5EC000 
  0x7C900000 \WINDOWS\System32\ntdll.dll

Processes (total 37):
       0 System Idle Process
       4 System
     608 C:\WINDOWS\System32\SMSS.EXE
     676 CSRSS.EXE
     700 C:\WINDOWS\System32\winlogon.exe
     744 C:\WINDOWS\System32\SERVICES.EXE
     756 C:\WINDOWS\System32\LSASS.EXE
     904 C:\WINDOWS\System32\SVCHOST.EXE
     952 SVCHOST.EXE
    1044 C:\WINDOWS\System32\SVCHOST.EXE
    1196 SVCHOST.EXE
    1252 SVCHOST.EXE
    1608 C:\WINDOWS\EXPLORER.EXE
    1784 C:\Program Files\AVAST Software\Avast\AvastSvc.exe
     316 C:\WINDOWS\System32\SPOOLSV.EXE
     656 C:\WINDOWS\System32\IGFXTRAY.EXE
     660 C:\WINDOWS\System32\HKCMD.EXE
     924 C:\WINDOWS\SOUNDMAN.EXE
     996 C:\WINDOWS\AGRSMMSG.EXE
    1012 C:\Program Files\LTMOH\LTMOH.EXE
    1024 C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    1032 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    1064 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
     808 SVCHOST.EXE
    1532 C:\Acer\eManager\anbmServ.exe
    1852 C:\Program Files\Java\JRE6\BIN\JQS.EXE
    1140 C:\Acer\ePM\EPM-DM.EXE
     480 C:\Program Files\Launch Manager\LManager.EXE
     556 C:\Program Files\AVAST Software\Avast\AvastUI.exe
     868 C:\Program Files\Common Files\Java\Java Update\JUSCHED.EXE
    2124 C:\Program Files\Skype\Phone\Skype.exe
    2148 C:\WINDOWS\System32\ctfmon.exe
    2188 C:\WINDOWS\System32\wuauclt.exe
    2704 wmiprvse.exe
    2968 C:\Program Files\Skype\Plugin Manager\skypePM.exe
    3036 alg.exe
    3408 C:\Documents and Settings\Lord Thunda\My Documents\Downloads\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`7d047e00  (FAT32)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000004`e1326600  (FAT32)

PhysicalDrive0 Model Number: TOSHIBAMK4025GAS, Rev: KA100A  

      Size  Device Name          MBR Status
  --------------------------------------------
     37 GB  \\.\PhysicalDrive0   Windows XP MBR code detected
            SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A


Done!
2011/03/15 14:30:00.0296 3708	TDSS rootkit removing tool 2.4.21.0 Mar 10 2011 12:26:28

2011/03/15 14:30:00.0562 3708	================================================================================

2011/03/15 14:30:00.0562 3708	SystemInfo:

2011/03/15 14:30:00.0562 3708	

2011/03/15 14:30:00.0562 3708	OS Version: 5.1.2600 ServicePack: 2.0

2011/03/15 14:30:00.0562 3708	Product type: Workstation

2011/03/15 14:30:00.0562 3708	ComputerName: LORD-THUNDA

2011/03/15 14:30:00.0562 3708	UserName: Lord Thunda

2011/03/15 14:30:00.0562 3708	Windows directory: C:\WINDOWS

2011/03/15 14:30:00.0562 3708	System windows directory: C:\WINDOWS

2011/03/15 14:30:00.0562 3708	Processor architecture: Intel x86

2011/03/15 14:30:00.0562 3708	Number of processors: 1

2011/03/15 14:30:00.0562 3708	Page size: 0x1000

2011/03/15 14:30:00.0562 3708	Boot type: Normal boot

2011/03/15 14:30:00.0562 3708	================================================================================

2011/03/15 14:30:01.0484 3708	Initialize success

2011/03/15 14:30:11.0328 3752	================================================================================

2011/03/15 14:30:11.0328 3752	Scan started

2011/03/15 14:30:11.0328 3752	Mode: Manual; 

2011/03/15 14:30:11.0328 3752	================================================================================

2011/03/15 14:30:12.0234 3752	Aavmker4        (83631291adf2887cffc786d034d3fa15) C:\WINDOWS\system32\drivers\Aavmker4.sys

2011/03/15 14:30:12.0718 3752	ACPI            (a10c7534f7223f4a73a948967d00e69b) C:\WINDOWS\system32\DRIVERS\ACPI.sys

2011/03/15 14:30:12.0843 3752	ACPIEC          (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys

2011/03/15 14:30:13.0156 3752	aec             (841f385c6cfaf66b58fbd898722bb4f0) C:\WINDOWS\system32\drivers\aec.sys

2011/03/15 14:30:13.0343 3752	AFD             (55e6e1c51b6d30e54335750955453702) C:\WINDOWS\System32\drivers\afd.sys

2011/03/15 14:30:13.0562 3752	AgereSoftModem  (b894a08f2a01e27c1989c31c96fdde83) C:\WINDOWS\system32\DRIVERS\AGRSM.sys

2011/03/15 14:30:14.0296 3752	ALCXSENS        (ba88534a3ceb6161e7432438b9ea4f54) C:\WINDOWS\system32\drivers\ALCXSENS.SYS

2011/03/15 14:30:14.0468 3752	ALCXWDM         (4d4593c10f2c90d48da9fd1b14ace825) C:\WINDOWS\system32\drivers\ALCXWDM.SYS

2011/03/15 14:30:14.0906 3752	Arp1394         (f0d692b0bffb46e30eb3cea168bbc49f) C:\WINDOWS\system32\DRIVERS\arp1394.sys

2011/03/15 14:30:15.0796 3752	aswFsBlk        (1c2e6bb4fe8621b1b863855b02bc33eb) C:\WINDOWS\system32\drivers\aswFsBlk.sys

2011/03/15 14:30:15.0984 3752	aswMon2         (452d0ecd14fa02f9b061f42c8a30dd49) C:\WINDOWS\system32\drivers\aswMon2.sys

2011/03/15 14:30:16.0218 3752	aswRdr          (b6a9373619d851be80fb5f1b5eed0d4e) C:\WINDOWS\system32\drivers\aswRdr.sys

2011/03/15 14:30:16.0406 3752	aswSnx          (9be41c1ae8bc481eb662d85c98d979c2) C:\WINDOWS\system32\drivers\aswSnx.sys

2011/03/15 14:30:16.0625 3752	aswSP           (4b1a54ba2bc5873a774df6b70ab8b0b3) C:\WINDOWS\system32\drivers\aswSP.sys

2011/03/15 14:30:16.0781 3752	aswTdi          (c7f1cea32766184911293f4e1ee653f5) C:\WINDOWS\system32\drivers\aswTdi.sys

2011/03/15 14:30:16.0921 3752	AsyncMac        (02000abf34af4c218c35d257024807d6) C:\WINDOWS\system32\DRIVERS\asyncmac.sys

2011/03/15 14:30:17.0109 3752	atapi           (cdfe4411a69c224bd1d11b2da92dac51) C:\WINDOWS\system32\DRIVERS\atapi.sys

2011/03/15 14:30:17.0390 3752	Atmarpc         (ec88da854ab7d7752ec8be11a741bb7f) C:\WINDOWS\system32\DRIVERS\atmarpc.sys

2011/03/15 14:30:17.0531 3752	audstub         (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys

2011/03/15 14:30:17.0687 3752	Beep            (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys

2011/03/15 14:30:17.0781 3752	cbidf2k         (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys

2011/03/15 14:30:18.0031 3752	Cdaudio         (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys

2011/03/15 14:30:18.0140 3752	Cdfs            (cd7d5152df32b47f4e36f710b35aae02) C:\WINDOWS\system32\drivers\Cdfs.sys

2011/03/15 14:30:18.0265 3752	Cdrom           (af9c19b3100fe010496b1a27181fbf72) C:\WINDOWS\system32\DRIVERS\cdrom.sys

2011/03/15 14:30:18.0656 3752	CmBatt          (4266be808f85826aedf3c64c1e240203) C:\WINDOWS\system32\DRIVERS\CmBatt.sys

2011/03/15 14:30:18.0921 3752	Compbatt        (df1b1a24bf52d0ebc01ed4ece8979f50) C:\WINDOWS\system32\DRIVERS\compbatt.sys

2011/03/15 14:30:19.0562 3752	Disk            (00ca44e4534865f8a3b64f7c0984bff0) C:\WINDOWS\system32\DRIVERS\disk.sys

2011/03/15 14:30:19.0750 3752	DKbFltr         (75ad9beb6d4b6bbcb39bfaba454ea05a) C:\WINDOWS\system32\DRIVERS\DKbFltr.sys

2011/03/15 14:30:19.0953 3752	dmboot          (c0fbb516e06e243f0cf31f597e7ebf7d) C:\WINDOWS\system32\drivers\dmboot.sys

2011/03/15 14:30:20.0093 3752	dmio            (f5e7b358a732d09f4bcf2824b88b9e28) C:\WINDOWS\system32\drivers\dmio.sys

2011/03/15 14:30:20.0140 3752	dmload          (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys

2011/03/15 14:30:20.0281 3752	D
0

HI Crunchie, i have the same problem as TGON, i have run all the checks you listed i.e

run tdsskiller

run the NTBR_CD and have run the MBR.exe which i will attach to this post.

but my hard drive space keeps going down 1mb every 30mins - 1hr is frustrating as all my a.v's say there is no threat.

can u help??

You need to begin your own thread as this thread is closed and solved. Please do not attach logs when you create your new thread, please copy/paste them.

This question has already been answered. Start a new discussion instead.
Have something to contribute to this discussion? Please be thoughtful, detailed and courteous, and be sure to adhere to our posting rules.