Ok MBAm updated came back clean?
Posible kit found but it may be you AV so we'll run another tool.

We should check your JAVA
Go into Control Panel>Add Remove Programs. Be sure the 'Show Updates' box is checked. Go down the list and tell me what Java applications are installed and their version.
(Highlight the program to see this).


Please download GMER from one of the following locations and save it to your desktop:

• Main Mirror
  This version will download a randomly named file (Recommended)
• Zipped Mirror
  This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.

• Disconnect from the Internet and close all running programs.
• Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.
• Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.
• Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.
  
  
  
• GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)
• If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system...click NO.
• Now click the Scan button. If you see a rootkit warning window, click OK.
• When the scan is finished, click the Save... button to save the scan results to your Desktop. Save the file as gmer.log.
• Click the Copy button and paste the results into your next reply.
• Exit GMER and be sure to re-enable your anti-virus, Firewall and any other security programs you had disabled.

-- If you encounter any problems, try running GMER in safe mode.
-- If GMER crashes or keeps resulting in a BSODs, uncheck Devices on the right side before scanning.

Yes, MBam came back clean.

For Java, the only one I see is Java 6 Update 3.

Here is the gmer file. It did hang when I ran it at first, so then I turned off devices and ran it.

MER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-01-28 19:59:12
Windows 5.1.2600 Service Pack 3
Running: 447d3vi9.exe; Driver: C:\DOCUME~1\SOMUser\LOCALS~1\Temp\uxtiypoc.sys


---- System - GMER 1.0.15 ----

SSDT 89D18D40 ZwAlertResumeThread
SSDT 89D1AA30 ZwAlertThread
SSDT 89F56D20 ZwAllocateVirtualMemory
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwClose [0x9B399BBC]
SSDT 89F1E9B8 ZwConnectPort
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateKey [0x9B399A78]
SSDT 8A0D01D0 ZwCreateMutant
SSDT 8A0CC860 ZwCreateThread
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDeleteKey [0x9B39A02C]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDeleteValueKey [0x9B399F56]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDuplicateObject [0x9B39964E]
SSDT 89F336B8 ZwFreeVirtualMemory
SSDT 89EB7458 ZwImpersonateAnonymousToken
SSDT 89D1E860 ZwImpersonateThread
SSDT 89F27730 ZwMapViewOfSection
SSDT 89D17520 ZwOpenEvent
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenKey [0x9B399B52]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenProcess [0x9B39958E]
SSDT 8A058098 ZwOpenProcessToken
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenThread [0x9B3995F2]
SSDT 89F15CA0 ZwOpenThreadToken
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwQueryValueKey [0x9B399C72]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwRenameKey [0x9B39A0FA]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwRestoreKey [0x9B399C32]
SSDT 8A0A4078 ZwResumeThread
SSDT 89D19AB0 ZwSetContextThread
SSDT 89FF47B0 ZwSetInformationProcess
SSDT 89F21170 ZwSetInformationThread
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwSetValueKey [0x9B399DB2]
SSDT 89EA58E8 ZwSuspendProcess
SSDT 89D1AF28 ZwSuspendThread
SSDT \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys (SASKUTIL.SYS/SUPERAdBlocker.com and SUPERAntiSpyware.com) ZwTerminateProcess [0x9B4D70B0]
SSDT 89D1AF98 ZwTerminateThread
SSDT 89D1D4C0 ZwUnmapViewOfSection
SSDT 8A0149E8 ZwWriteVirtualMemory

Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateProcessEx [0x9B3A6322]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateSection [0x9B3A614C]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwLoadDriver [0x9B3A6280]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) NtCreateSection
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ObInsertObject
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ObMakeTemporaryObject

---- Kernel code sections - GMER 1.0.15 ----

.text ntkrnlpa.exe!ZwCallbackReturn + 2C40 805044DC 4 Bytes JMP CECCCED2
.text ntkrnlpa.exe!ZwCallbackReturn + 2D30 805045CC 4 Bytes CALL 9958CFA2
.text ntkrnlpa.exe!ZwCallbackReturn + 2FB8 80504854 8 Bytes CALL A8DA32B1
.text ntkrnlpa.exe!ZwCallbackReturn + 3018 805048B4 4 Bytes CALL 68DA4A02
PAGE ntkrnlpa.exe!ZwLoadDriver 8058413A 7 Bytes JMP 9B3A6284 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)
PAGE ntkrnlpa.exe!NtCreateSection 805AB3AC 7 Bytes JMP 9B3A6150 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)
PAGE ntkrnlpa.exe!ObMakeTemporaryObject 805BC520 5 Bytes JMP 9B3A2594 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)
PAGE ntkrnlpa.exe!ObInsertObject 805C2FA4 5 Bytes JMP 9B3A3866 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)
PAGE ntkrnlpa.exe!ZwCreateProcessEx 805D1144 7 Bytes JMP 9B3A6326 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)
.rsrc C:\WINDOWS\system32\drivers\iaStor.sys entry point in ".rsrc" section [0xB9F08000]

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\WINDOWS\system32\services.exe[984] @ C:\WINDOWS\system32\services.exe [ADVAPI32.dll!CreateProcessAsUserW] 00380002
IAT C:\WINDOWS\system32\services.exe[984] @ C:\WINDOWS\system32\services.exe [KERNEL32.dll!CreateProcessW] 00380000

---- Disk sectors - GMER 1.0.15 ----

Disk \Device\Harddisk0\DR0 sector 61: copy of MBR
Disk \Device\Harddisk0\DR0 sector 62: copy of MBR

---- Files - GMER 1.0.15 ----

ADS C:\System Volume Information\_restore{4206FD7B-9287-4B27-8D55-9A28663DF20F}\RP385\A0049295.exe:BAK 22528 bytes executable
ADS C:\System Volume Information\_restore{4206FD7B-9287-4B27-8D55-9A28663DF20F}\RP386\A0050324.exe:BAK 22528 bytes executable
ADS C:\System Volume Information\_restore{4206FD7B-9287-4B27-8D55-9A28663DF20F}\RP386\A0050404.exe:BAK 22528 bytes executable
ADS C:\System Volume Information\_restore{4206FD7B-9287-4B27-8D55-9A28663DF20F}\RP386\A0050437.exe:BAK 22528 bytes executable
ADS C:\System Volume Information\_restore{4206FD7B-9287-4B27-8D55-9A28663DF20F}\RP386\A0050454.exe:BAK 22528 bytes executable
ADS C:\System Volume Information\_restore{4206FD7B-9287-4B27-8D55-9A28663DF20F}\RP386\A0050464.exe:BAK 22528 bytes executable
ADS C:\System Volume Information\_restore{4206FD7B-9287-4B27-8D55-9A28663DF20F}\RP386\A0050557.exe:BAK 22528 bytes executable
File C:\WINDOWS\system32\drivers\iaStor.sys suspicious modification

---- EOF - GMER 1.0.15 ----

Hello we have 2 things to so

Your version of Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system. Please follow these steps to remove older version Java components and update:

• Download the latest version of Java Runtime Environment (JRE) Version 6 and save it to your desktop.
• Look for "JDK 6 Update 18 (JDK or JRE)".
• Click the "Download JRE" button to the right.
• Select your Platform: "Windows".
• Select your Language: "Multi-language".
• Read the License Agreement, and then check the box that says: "Accept License Agreement".
• Click Continue and the page will refresh.
• Under Required Files, check the box for Windows Offline Installation, click the link below it and save the file to your desktop.
• Close any programs you may have running - especially your web browser.

Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.

• Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
• Click the Remove or Change/Remove button and follow the onscreen instructions for the Java uninstaller.
• Repeat as many times as necessary to remove each Java versions.
• Reboot your computer once all Java components are removed.
• Then from your desktop double-click on jre-6u18-windows-i586.exe to install the newest version.
• If using Windows Vista and the installer refuses to launch due to insufficient user permissions, then Run As Administrator.
• When the Java Setup - Welcome window opens, click the Install > button.
• If offered to install a Toolbar, just uncheck the box before continuing unless you want it.

-- Starting with Java 6u10, the uninstaller incorporated in each new release uses Enhanced Auto update to automatically remove the previous version when updating to a later update release. It will not remove older versions, so they will need to be removed manually.
-- Java is updated frequently. If you want to be automatically notified of future updates, just turn on the Java Automatic Update feature and you will not have to remember to update when Java releases a new version.

Note: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. To disable the JQS service if you don't want to use it, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click Ok and reboot your computer.


Now you will need to run HJT/DDS. The rootkit is modifying your iaStor.sys file.

Please follow this guide. go and do steps 6 thru 8 ,, Preparation Guide For Use Before Using Hijackthis. Skip RootRepeal and post the GMER log.
Then go here HijackThis Logs and Virus/Trojan/Spyware/Malware Removal ,click New Topic,give it a relevant Title (iaStor.sys suspicious modification)and post that complete log.

Let me know if it went OK.

I can do that, but at this point, it might be easier and safer to set the computer back to factory default settings. It says that this reformats the drive and you lose all your info (which I have backed up). Will that get rid of the rootkit or do I need to reformat in some other way?

And assuming that works, should I plug in the USB drives/external hard drives and run the various AV programs on them before I restore any data? I saw your notes about not backing up .exe files.

Not an unwise decision to make. In some instances an infection may have caused so much damage to your system that it cannot be completely cleaned or repaired. Wiping your drive, reformatting, and performing a clean install of the OS or doing a factory restore removes everything and is the safest action but I cannot make that decision for you.

Reformatting a hard disk deletes all data. If you decide to reformat, you can back up all your important documents, data files and photos. The safest practice is not to backup any autorun.ini or .exe files because they may be infected. Some types of malware may disguise itself by adding and hiding its extension to the existing extension of files so be sure you take a close look at the full name. After reformatting, as a precaution, make sure you scan these files with your anti-virus prior to copying them back to your hard drive.


Reinstall Windows Vista

Boopme, THANK YOU very much for all your help. I've reformatted and everything looks great. Now I will go check and secure the rest of the computers at my house. I really appreciate your time and I've learned alot!

You're welcome from all of us here at BC. We are glad to have helped.
Please take a few minutes to read our quietman7's excellent Tips to protect yourself against malware and reduce the potential for re-infection:,in post 17.