BleepingComputer.com: Win32k.sys or ZeroAccess

Weeks ago, I was using my laptop when it suddenly experienced a massive bout of malware, as a fake virus protection software showed that I was supposedly infected with tons of viruses. Instantly realizing the scam I shut it down, and manually found the file that was spawning it, and removed it. Aftwards, all of my file extensions broke.

I did a google search, found the way to fix the .exes, then ran AVG which detected numerous rootkits. I attempted to remove them, but I believe my computer became really slow and crashed. Afterwards, I attempted to run a scan again, but no infection was shown, though I was still experiencing extreme lag, and my computer would occasionally freeze. I also had a ping.exe file and a ping6.exe file showing up in my system32 folder that avast was constantly detecting, as well as some drivers that were infected, according to AVG(or security essentials, I can't remember). After a couple of restarts, AVG couldn't run a scan, and avast could not either. I had Norton Internet Security, or some such program, but it kept killing AVG, while failing to function itself.

I had to leave town for a while and couldn't use that laptop, but now I can't since the admin password was hacked and change, too. I can't run recovery console with the boot disk.

Now, I have a different laptop which I needed for other things, and it also has the same rootkit detected by avg. I believe it's because I'm using the wireless network that my neighbor gave me the pass to, after I could no longer afford my own connection. That's the only common denominator between my old laptop, and this one.

Anyway, I hope this problem gets solved before the rootkit kills my new PC, which I can't reformat, and doubt I'll be able to repair(due to a lack of a bootdisk)

I am using windows 7, so I cannot run GMER. Here is the DDS log.

.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 8.0.7601.17514
Run by User at 21:34:35 on 2011-12-26
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3563.1641 [GMT -8:00]
.
AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
AV: AVG Anti-Virus 2012 *Enabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: AVG Anti-Virus 2012 *Enabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
svchost.exe
svchost.exe
svchost.exe
svchost.exe
svchost.exe
svchost.exe
svchost.exe
svchost.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\IDT\WDM\sttray64.exe
C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Windows\system32\taskeng.exe
C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
svchost.exe
C:\Users\User\AppData\Roaming\Spotify\spotify.exe
C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
C:\Program Files (x86)\AVG\AVG2012\avgtray.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files (x86)\Acronis\DriveMonitor\adm_tray.exe
C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Windows\system32\wuauclt.exe
C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Microsoft Visual Studio 9.0\Common7\IDE\VCExpress.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\conhost.exe
C:\Windows\SysWOW64\cscript.exe
.
============== Pseudo HJT Report ===============
.
mWinlogon: Userinit=userinit.exe
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - C:\Program Files (x86)\AVG\AVG2012\avgssie.dll
BHO: {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - No File
BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
uRun: [Google Update] "C:\Users\User\AppData\Local\Google\Update\GoogleUpdate.exe" /c
uRun: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
uRun: [Spotify] "C:\Users\User\AppData\Roaming\Spotify\Spotify.exe" /uri spotify:autostart
mRun: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
mRun: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
mRun: [HPOSD] C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
mRun: [AVG_TRAY] "C:\Program Files (x86)\AVG\AVG2012\avgtray.exe"
mRun: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
mRun: [adm_tray.exe] C:\Program Files (x86)\Acronis\DriveMonitor\adm_tray.exe
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
TCP: DhcpNameServer = 172.16.42.1
TCP: Interfaces\{658633F3-3F97-41BA-A26F-A2AD752E9F03} : DhcpNameServer = 172.16.42.1
TCP: Interfaces\{658633F3-3F97-41BA-A26F-A2AD752E9F03}\45F6D6E445F6D6370235F6C6169627 : DhcpNameServer = 192.168.1.254
TCP: Interfaces\{658633F3-3F97-41BA-A26F-A2AD752E9F03}\D62736F666665656 : DhcpNameServer = 66.75.164.89 66.75.164.90
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\AMD\SteadyVideo\VideoMIMEFilter.dll
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\AMD\SteadyVideo\VideoMIMEFilter.dll
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgpp.dll
BHO-X64: AVG Safe Search: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssie.dll
BHO-X64: WormRadar.com IESiteBlocker.NavFilter - No File
BHO-X64: {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - No File
BHO-X64: AMD SteadyVideo BHO - No File
BHO-X64: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
TB-X64: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
mRun-x64: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
mRun-x64: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
mRun-x64: [HPOSD] C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
mRun-x64: [AVG_TRAY] "C:\Program Files (x86)\AVG\AVG2012\avgtray.exe"
mRun-x64: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
mRun-x64: [adm_tray.exe] C:\Program Files (x86)\Acronis\DriveMonitor\adm_tray.exe
.
============= SERVICES / DRIVERS ===============
.
R0 amd_sata;amd_sata;C:\Windows\system32\DRIVERS\amd_sata.sys --> C:\Windows\system32\DRIVERS\amd_sata.sys [?]
R0 amd_xata;amd_xata;C:\Windows\system32\DRIVERS\amd_xata.sys --> C:\Windows\system32\DRIVERS\amd_xata.sys [?]
R0 AVGIDSEH;AVGIDSEH;C:\Windows\system32\DRIVERS\AVGIDSEH.Sys --> C:\Windows\system32\DRIVERS\AVGIDSEH.Sys [?]
R0 Avgrkx64;AVG Anti-Rootkit Driver;C:\Windows\system32\DRIVERS\avgrkx64.sys --> C:\Windows\system32\DRIVERS\avgrkx64.sys [?]
R1 aswSnx;aswSnx;C:\Windows\system32\drivers\aswSnx.sys --> C:\Windows\system32\drivers\aswSnx.sys [?]
R1 aswSP;aswSP;C:\Windows\system32\drivers\aswSP.sys --> C:\Windows\system32\drivers\aswSP.sys [?]
R1 Avgldx64;AVG AVI Loader Driver;C:\Windows\system32\DRIVERS\avgldx64.sys --> C:\Windows\system32\DRIVERS\avgldx64.sys [?]
R1 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;C:\Windows\system32\DRIVERS\avgmfx64.sys --> C:\Windows\system32\DRIVERS\avgmfx64.sys [?]
R1 Avgtdia;AVG TDI Driver;C:\Windows\system32\DRIVERS\avgtdia.sys --> C:\Windows\system32\DRIVERS\avgtdia.sys [?]
R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]
R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\system32\atiesrxx.exe --> C:\Windows\system32\atiesrxx.exe [?]
R2 AMD FUEL Service;AMD FUEL Service;C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2011-7-5 365568]
R2 aswFsBlk;aswFsBlk;C:\Windows\system32\drivers\aswFsBlk.sys --> C:\Windows\system32\drivers\aswFsBlk.sys [?]
R2 aswMonFlt;aswMonFlt;\??\C:\Windows\system32\drivers\aswMonFlt.sys --> C:\Windows\system32\drivers\aswMonFlt.sys [?]
R2 avast! Antivirus;avast! Antivirus;C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2011-12-22 44768]
R2 AVGIDSAgent;AVGIDSAgent;C:\Program Files (x86)\AVG\AVG2012\AVGIDSAgent.exe [2011-10-12 4433248]
R2 avgwd;AVG WatchDog;C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe [2011-8-2 192776]
R2 HP Support Assistant Service;HP Support Assistant Service;C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe [2011-6-21 85560]
R2 HPDrvMntSvc.exe;HP Quick Synchronization Service;C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-5-21 103992]
R2 HPWMISVC;HPWMISVC;C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2011-4-8 26680]
R2 IconMan_R;IconMan_R;C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [2011-12-22 2375168]
R3 amdiox64;AMD IO Driver;C:\Windows\system32\DRIVERS\amdiox64.sys --> C:\Windows\system32\DRIVERS\amdiox64.sys [?]
R3 amdkmdag;amdkmdag;C:\Windows\system32\DRIVERS\atikmdag.sys --> C:\Windows\system32\DRIVERS\atikmdag.sys [?]
R3 amdkmdap;amdkmdap;C:\Windows\system32\DRIVERS\atikmpag.sys --> C:\Windows\system32\DRIVERS\atikmpag.sys [?]
R3 AtiHDAudioService;ATI Function Driver for HD Audio Service;C:\Windows\system32\drivers\AtihdW76.sys --> C:\Windows\system32\drivers\AtihdW76.sys [?]
R3 AVGIDSDriver;AVGIDSDriver;C:\Windows\system32\DRIVERS\AVGIDSDriver.Sys --> C:\Windows\system32\DRIVERS\AVGIDSDriver.Sys [?]
R3 AVGIDSFilter;AVGIDSFilter;C:\Windows\system32\DRIVERS\AVGIDSFilter.Sys --> C:\Windows\system32\DRIVERS\AVGIDSFilter.Sys [?]
R3 clwvd;CyberLink WebCam Virtual Driver;C:\Windows\system32\DRIVERS\clwvd.sys --> C:\Windows\system32\DRIVERS\clwvd.sys [?]
R3 netr28x;Ralink 802.11n Extensible Wireless Driver;C:\Windows\system32\DRIVERS\netr28x.sys --> C:\Windows\system32\DRIVERS\netr28x.sys [?]
R3 RSPCIESTOR;Realtek PCIE CardReader Driver;C:\Windows\system32\DRIVERS\RtsPStor.sys --> C:\Windows\system32\DRIVERS\RtsPStor.sys [?]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]
R3 usbfilter;AMD USB Filter Driver;C:\Windows\system32\DRIVERS\usbfilter.sys --> C:\Windows\system32\DRIVERS\usbfilter.sys [?]
S3 SrvHsfHDA;SrvHsfHDA;C:\Windows\system32\DRIVERS\VSTAZL6.SYS --> C:\Windows\system32\DRIVERS\VSTAZL6.SYS [?]
S3 SrvHsfV92;SrvHsfV92;C:\Windows\system32\DRIVERS\VSTDPV6.SYS --> C:\Windows\system32\DRIVERS\VSTDPV6.SYS [?]
S3 SrvHsfWinac;SrvHsfWinac;C:\Windows\system32\DRIVERS\VSTCNXT6.SYS --> C:\Windows\system32\DRIVERS\VSTCNXT6.SYS [?]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]
S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\system32\drivers\TsUsbGD.sys --> C:\Windows\system32\drivers\TsUsbGD.sys [?]
S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;C:\Program Files (x86)\Microsoft SQL Server\100\Shared\sqladhlp.exe [2008-7-10 47128]
S4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);C:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [2008-7-10 369688]
.
=============== Created Last 30 ================
.
2011-12-24 05:43:40 -------- d-----w- C:\Users\User\AppData\Local\Hewlett-Packard
2011-12-23 05:20:30 388096 ----a-r- C:\Users\User\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-12-23 05:20:29 -------- d-----w- C:\Program Files (x86)\Trend Micro
2011-12-23 03:27:51 50200 ----a-w- C:\Windows\SysWow64\perf-SQLAgent$SQLEXPRESS-sqlagtctr10.0.1600.22.dll
2011-12-23 03:27:39 79896 ----a-w- C:\Windows\SysWow64\perf-MSSQL$SQLEXPRESS-sqlctr10.0.1600.22.dll
2011-12-23 03:26:07 -------- d-----w- C:\Windows\SysWow64\1033
2011-12-23 03:26:07 -------- d-----w- C:\Windows\System32\1033
2011-12-23 03:26:07 -------- d-----w- C:\Program Files\Microsoft SQL Server
2011-12-23 03:23:40 -------- d-----w- C:\Program Files (x86)\Microsoft SQL Server
2011-12-23 03:22:51 -------- d-----w- C:\Users\User\AppData\Local\Microsoft Help
2011-12-23 03:20:32 -------- d-----w- C:\Program Files (x86)\Common Files\Merge Modules
2011-12-23 03:12:15 -------- d--h--w- C:\$AVG
2011-12-23 02:58:18 -------- d-----w- C:\Users\User\AppData\Local\Spotify
2011-12-23 02:57:42 -------- d-----w- C:\Users\User\AppData\Roaming\Spotify
2011-12-23 02:54:09 -------- d-----w- C:\Users\User\AppData\Local\Diagnostics
2011-12-23 02:53:39 -------- d-----w- C:\Users\User\AppData\Roaming\AVG2012
2011-12-23 02:35:48 -------- d-----w- C:\Program Files (x86)\AVG
2011-12-23 02:31:45 -------- d--h--w- C:\ProgramData\Common Files
2011-12-23 02:31:29 -------- d-----w- C:\ProgramData\MFAData
2011-12-23 02:30:45 -------- d-----w- C:\Users\User\AppData\Local\Google
2011-12-23 02:30:33 -------- d-----w- C:\Users\User\AppData\Local\Apps
2011-12-23 02:30:32 -------- d-----w- C:\Users\User\AppData\Local\Deployment
2011-12-23 02:25:02 -------- d-----w- C:\Users\User\AppData\Local\AMD
2011-12-23 02:24:47 -------- d-----w- C:\Users\User\AppData\Local\ATI
2011-12-23 02:23:44 -------- d-----w- C:\Users\User\AppData\Roaming\Synaptics
2011-12-23 02:23:43 -------- d-----w- C:\Users\User\AppData\Roaming\hpqLog
2011-12-23 02:23:15 -------- d-----w- C:\Users\User\AppData\Local\VirtualStore
2011-12-23 02:13:57 -------- d-----w- C:\ProgramData\Synaptics
2011-12-23 02:05:41 -------- d-----w- C:\ProgramData\{D3B41B92-9BC2-43EB-916A-4FA9E8191837}
2011-12-23 02:05:22 404640 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2011-12-23 02:01:20 0 ----a-w- C:\Windows\ativpsrm.bin
2011-12-23 02:00:19 6382080 ----a-w- C:\Windows\System32\IDTNGUI.exe
2011-12-23 02:00:19 564224 ----a-w- C:\Windows\System32\idt64mp1.exe
2011-12-23 02:00:19 4933120 ----a-w- C:\Windows\System32\IDTNHP.dll
2011-12-23 02:00:19 4780032 ----a-w- C:\Windows\System32\stlang64.dll
2011-12-23 02:00:19 212480 ----a-w- C:\Windows\System32\IDTNJ.exe
2011-12-23 02:00:19 1523712 ----a-w- C:\Windows\System32\IDTNC64.cpl
2011-12-23 02:00:19 1128448 ----a-w- C:\Windows\sttray64.exe
2011-12-23 02:00:19 1029120 ----a-w- C:\Windows\System32\IDTNX.dll
2011-12-23 02:00:18 -------- d-----w- C:\Windows\System32\SRSLabs
2011-12-23 01:59:36 224256 ----a-w- C:\Windows\System32\staco64.dll
2011-12-23 01:59:35 654336 ------w- C:\Windows\System32\stapi64.dll
2011-12-23 01:59:35 528384 ----a-w- C:\Windows\System32\drivers\stwrt64.sys
2011-12-23 01:59:35 431616 ----a-w- C:\Windows\System32\stcplx64.dll
2011-12-23 01:59:35 1965056 ----a-w- C:\Windows\System32\in3stapo64.dll
2011-12-23 01:59:29 -------- d-----w- C:\Program Files\IDT
2011-12-23 01:59:26 -------- d-----w- C:\Windows\SysWow64\sda
2011-12-23 01:59:17 9888360 ----a-w- C:\Windows\SysWow64\RtsPStorIcon.dll
2011-12-23 01:59:17 338536 ----a-w- C:\Windows\System32\drivers\RtsPStor.sys
2011-12-23 01:58:32 74272 ----a-w- C:\Windows\System32\RtNicProp64.dll
2011-12-23 01:58:32 533096 ----a-w- C:\Windows\System32\drivers\Rt64win7.sys
2011-12-23 01:58:32 107552 ----a-w- C:\Windows\System32\RTNUninst64.dll
2011-12-23 01:58:29 -------- d-----w- C:\Program Files (x86)\Realtek
2011-12-23 01:58:16 -------- d-----w- C:\Program Files\Synaptics
2011-12-23 01:57:48 -------- d-----w- C:\Windows\Hewlett-Packard
2011-12-23 01:57:19 327008 ----a-w- C:\Windows\System32\RaCoInstx.dll
2011-12-23 01:57:19 1488448 ----a-w- C:\Windows\System32\drivers\netr28x.sys
2011-12-23 01:57:18 -------- d-----w- C:\ProgramData\Ralink Driver
2011-12-23 01:57:07 -------- d-----w- C:\Program Files\AMD
2011-12-23 01:57:07 -------- d-----w- C:\Program Files (x86)\AMD
2011-12-23 01:57:04 -------- d-----w- C:\Program Files (x86)\AMD APP
2011-12-23 01:57:00 -------- d-----w- C:\Program Files\Common Files\ATI Technologies
2011-12-23 01:57:00 -------- d-----w- C:\Program Files (x86)\Common Files\ATI Technologies
2011-12-23 01:56:08 46136 ----a-w- C:\Windows\System32\drivers\amdiox64.sys
2011-12-23 01:56:08 -------- d-----w- C:\ProgramData\AMD
2011-12-23 01:56:07 -------- d-----w- C:\Program Files\ATI Technologies
2011-12-23 01:56:00 47232 ----a-w- C:\Windows\System32\drivers\usbfilter.sys
2011-12-23 01:55:34 -------- d-----w- C:\Program Files\ATI
2011-12-23 01:55:32 -------- d-----w- C:\Program Files (x86)\ATI Technologies
2011-12-23 01:55:03 -------- d-sh--w- C:\Windows\Installer
2011-12-23 01:46:22 -------- d-----w- C:\Windows\ehome
.
==================== Find3M ====================
.
2011-11-28 18:01:25 41184 ----a-w- C:\Windows\avastSS.scr
2011-11-28 17:54:06 591192 ----a-w- C:\Windows\System32\drivers\aswSnx.sys
2011-11-28 17:52:11 66904 ----a-w- C:\Windows\System32\drivers\aswMonFlt.sys
2011-10-07 14:23:46 283728 ----a-w- C:\Windows\System32\drivers\avgldx64.sys
.
============= FINISH: 21:38:05.49 ===============

This post has been edited by Distressed Waif: 27 December 2011 - 01:24 AM

Weeks ago, I was using my laptop when it suddenly experienced a massive bout of malware, as a fake virus protection software showed that I was supposedly infected with tons of viruses. Instantly realizing the scam I shut it down, and manually found the file that was spawning it, and removed it. Aftwards, all of my file extensions broke.

I did a google search, found the way to fix the .exes, then ran AVG which detected numerous rootkits. I attempted to remove them, but I believe my computer became really slow and crashed. Afterwards, I attempted to run a scan again, but no infection was shown, though I was still experiencing extreme lag, and my computer would occasionally lag. I also had a ping.exe file and a ping6.exe file showing up in my system32 folder that avast was constantly detecting. After a couple of restarts, AVG couldn't run a scan, and avast could not either. I had Norton Internet Security, or some such program, but it kept killing AVG, while failing to function itself.

I had to leave town for a while and couldn't use that laptop, but now that I'm back, I can't since the admin password was hacked and changed, too. I can't run recovery console with the boot disk.

Now, I have a different laptop which I needed for other things, and it also has the same rootkit detected by avg. I believe it's because I'm using the wireless network that my neighbor gave me the pass to, after I could no longer afford my own connection. That's the only common denominator between my old laptop, and this one.

Anyway, I hope this problem gets solved before the rootkit kills my new PC, which I can't reformat, and doubt I'll be able to repair(due to a lack of a bootdisk)

I am using windows 7, so I cannot run GMER. Here is the DDS log.

.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 8.0.7601.17514
Run by User at 21:34:35 on 2011-12-26
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3563.1641 [GMT -8:00]
.
AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
AV: AVG Anti-Virus 2012 *Enabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: AVG Anti-Virus 2012 *Enabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
svchost.exe
svchost.exe
svchost.exe
svchost.exe
svchost.exe
svchost.exe
svchost.exe
svchost.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\IDT\WDM\sttray64.exe
C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Windows\system32\taskeng.exe
C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
svchost.exe
C:\Users\User\AppData\Roaming\Spotify\spotify.exe
C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
C:\Program Files (x86)\AVG\AVG2012\avgtray.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files (x86)\Acronis\DriveMonitor\adm_tray.exe
C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Windows\system32\wuauclt.exe
C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Microsoft Visual Studio 9.0\Common7\IDE\VCExpress.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\conhost.exe
C:\Windows\SysWOW64\cscript.exe
.
============== Pseudo HJT Report ===============
.
mWinlogon: Userinit=userinit.exe
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - C:\Program Files (x86)\AVG\AVG2012\avgssie.dll
BHO: {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - No File
BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
uRun: [Google Update] "C:\Users\User\AppData\Local\Google\Update\GoogleUpdate.exe" /c
uRun: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
uRun: [Spotify] "C:\Users\User\AppData\Roaming\Spotify\Spotify.exe" /uri spotify:autostart
mRun: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
mRun: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
mRun: [HPOSD] C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
mRun: [AVG_TRAY] "C:\Program Files (x86)\AVG\AVG2012\avgtray.exe"
mRun: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
mRun: [adm_tray.exe] C:\Program Files (x86)\Acronis\DriveMonitor\adm_tray.exe
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
TCP: DhcpNameServer = 172.16.42.1
TCP: Interfaces\{658633F3-3F97-41BA-A26F-A2AD752E9F03} : DhcpNameServer = 172.16.42.1
TCP: Interfaces\{658633F3-3F97-41BA-A26F-A2AD752E9F03}\45F6D6E445F6D6370235F6C6169627 : DhcpNameServer = 192.168.1.254
TCP: Interfaces\{658633F3-3F97-41BA-A26F-A2AD752E9F03}\D62736F666665656 : DhcpNameServer = 66.75.164.89 66.75.164.90
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\AMD\SteadyVideo\VideoMIMEFilter.dll
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\AMD\SteadyVideo\VideoMIMEFilter.dll
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgpp.dll
BHO-X64: AVG Safe Search: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssie.dll
BHO-X64: WormRadar.com IESiteBlocker.NavFilter - No File
BHO-X64: {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - No File
BHO-X64: AMD SteadyVideo BHO - No File
BHO-X64: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
TB-X64: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
mRun-x64: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
mRun-x64: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
mRun-x64: [HPOSD] C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
mRun-x64: [AVG_TRAY] "C:\Program Files (x86)\AVG\AVG2012\avgtray.exe"
mRun-x64: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
mRun-x64: [adm_tray.exe] C:\Program Files (x86)\Acronis\DriveMonitor\adm_tray.exe
.
============= SERVICES / DRIVERS ===============
.
R0 amd_sata;amd_sata;C:\Windows\system32\DRIVERS\amd_sata.sys --> C:\Windows\system32\DRIVERS\amd_sata.sys [?]
R0 amd_xata;amd_xata;C:\Windows\system32\DRIVERS\amd_xata.sys --> C:\Windows\system32\DRIVERS\amd_xata.sys [?]
R0 AVGIDSEH;AVGIDSEH;C:\Windows\system32\DRIVERS\AVGIDSEH.Sys --> C:\Windows\system32\DRIVERS\AVGIDSEH.Sys [?]
R0 Avgrkx64;AVG Anti-Rootkit Driver;C:\Windows\system32\DRIVERS\avgrkx64.sys --> C:\Windows\system32\DRIVERS\avgrkx64.sys [?]
R1 aswSnx;aswSnx;C:\Windows\system32\drivers\aswSnx.sys --> C:\Windows\system32\drivers\aswSnx.sys [?]
R1 aswSP;aswSP;C:\Windows\system32\drivers\aswSP.sys --> C:\Windows\system32\drivers\aswSP.sys [?]
R1 Avgldx64;AVG AVI Loader Driver;C:\Windows\system32\DRIVERS\avgldx64.sys --> C:\Windows\system32\DRIVERS\avgldx64.sys [?]
R1 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;C:\Windows\system32\DRIVERS\avgmfx64.sys --> C:\Windows\system32\DRIVERS\avgmfx64.sys [?]
R1 Avgtdia;AVG TDI Driver;C:\Windows\system32\DRIVERS\avgtdia.sys --> C:\Windows\system32\DRIVERS\avgtdia.sys [?]
R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]
R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\system32\atiesrxx.exe --> C:\Windows\system32\atiesrxx.exe [?]
R2 AMD FUEL Service;AMD FUEL Service;C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2011-7-5 365568]
R2 aswFsBlk;aswFsBlk;C:\Windows\system32\drivers\aswFsBlk.sys --> C:\Windows\system32\drivers\aswFsBlk.sys [?]
R2 aswMonFlt;aswMonFlt;\??\C:\Windows\system32\drivers\aswMonFlt.sys --> C:\Windows\system32\drivers\aswMonFlt.sys [?]
R2 avast! Antivirus;avast! Antivirus;C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2011-12-22 44768]
R2 AVGIDSAgent;AVGIDSAgent;C:\Program Files (x86)\AVG\AVG2012\AVGIDSAgent.exe [2011-10-12 4433248]
R2 avgwd;AVG WatchDog;C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe [2011-8-2 192776]
R2 HP Support Assistant Service;HP Support Assistant Service;C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe [2011-6-21 85560]
R2 HPDrvMntSvc.exe;HP Quick Synchronization Service;C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-5-21 103992]
R2 HPWMISVC;HPWMISVC;C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2011-4-8 26680]
R2 IconMan_R;IconMan_R;C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [2011-12-22 2375168]
R3 amdiox64;AMD IO Driver;C:\Windows\system32\DRIVERS\amdiox64.sys --> C:\Windows\system32\DRIVERS\amdiox64.sys [?]
R3 amdkmdag;amdkmdag;C:\Windows\system32\DRIVERS\atikmdag.sys --> C:\Windows\system32\DRIVERS\atikmdag.sys [?]
R3 amdkmdap;amdkmdap;C:\Windows\system32\DRIVERS\atikmpag.sys --> C:\Windows\system32\DRIVERS\atikmpag.sys [?]
R3 AtiHDAudioService;ATI Function Driver for HD Audio Service;C:\Windows\system32\drivers\AtihdW76.sys --> C:\Windows\system32\drivers\AtihdW76.sys [?]
R3 AVGIDSDriver;AVGIDSDriver;C:\Windows\system32\DRIVERS\AVGIDSDriver.Sys --> C:\Windows\system32\DRIVERS\AVGIDSDriver.Sys [?]
R3 AVGIDSFilter;AVGIDSFilter;C:\Windows\system32\DRIVERS\AVGIDSFilter.Sys --> C:\Windows\system32\DRIVERS\AVGIDSFilter.Sys [?]
R3 clwvd;CyberLink WebCam Virtual Driver;C:\Windows\system32\DRIVERS\clwvd.sys --> C:\Windows\system32\DRIVERS\clwvd.sys [?]
R3 netr28x;Ralink 802.11n Extensible Wireless Driver;C:\Windows\system32\DRIVERS\netr28x.sys --> C:\Windows\system32\DRIVERS\netr28x.sys [?]
R3 RSPCIESTOR;Realtek PCIE CardReader Driver;C:\Windows\system32\DRIVERS\RtsPStor.sys --> C:\Windows\system32\DRIVERS\RtsPStor.sys [?]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]
R3 usbfilter;AMD USB Filter Driver;C:\Windows\system32\DRIVERS\usbfilter.sys --> C:\Windows\system32\DRIVERS\usbfilter.sys [?]
S3 SrvHsfHDA;SrvHsfHDA;C:\Windows\system32\DRIVERS\VSTAZL6.SYS --> C:\Windows\system32\DRIVERS\VSTAZL6.SYS [?]
S3 SrvHsfV92;SrvHsfV92;C:\Windows\system32\DRIVERS\VSTDPV6.SYS --> C:\Windows\system32\DRIVERS\VSTDPV6.SYS [?]
S3 SrvHsfWinac;SrvHsfWinac;C:\Windows\system32\DRIVERS\VSTCNXT6.SYS --> C:\Windows\system32\DRIVERS\VSTCNXT6.SYS [?]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]
S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\system32\drivers\TsUsbGD.sys --> C:\Windows\system32\drivers\TsUsbGD.sys [?]
S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;C:\Program Files (x86)\Microsoft SQL Server\100\Shared\sqladhlp.exe [2008-7-10 47128]
S4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);C:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [2008-7-10 369688]
.
=============== Created Last 30 ================
.
2011-12-24 05:43:40 -------- d-----w- C:\Users\User\AppData\Local\Hewlett-Packard
2011-12-23 05:20:30 388096 ----a-r- C:\Users\User\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-12-23 05:20:29 -------- d-----w- C:\Program Files (x86)\Trend Micro
2011-12-23 03:27:51 50200 ----a-w- C:\Windows\SysWow64\perf-SQLAgent$SQLEXPRESS-sqlagtctr10.0.1600.22.dll
2011-12-23 03:27:39 79896 ----a-w- C:\Windows\SysWow64\perf-MSSQL$SQLEXPRESS-sqlctr10.0.1600.22.dll
2011-12-23 03:26:07 -------- d-----w- C:\Windows\SysWow64\1033
2011-12-23 03:26:07 -------- d-----w- C:\Windows\System32\1033
2011-12-23 03:26:07 -------- d-----w- C:\Program Files\Microsoft SQL Server
2011-12-23 03:23:40 -------- d-----w- C:\Program Files (x86)\Microsoft SQL Server
2011-12-23 03:22:51 -------- d-----w- C:\Users\User\AppData\Local\Microsoft Help
2011-12-23 03:20:32 -------- d-----w- C:\Program Files (x86)\Common Files\Merge Modules
2011-12-23 03:12:15 -------- d--h--w- C:\$AVG
2011-12-23 02:58:18 -------- d-----w- C:\Users\User\AppData\Local\Spotify
2011-12-23 02:57:42 -------- d-----w- C:\Users\User\AppData\Roaming\Spotify
2011-12-23 02:54:09 -------- d-----w- C:\Users\User\AppData\Local\Diagnostics
2011-12-23 02:53:39 -------- d-----w- C:\Users\User\AppData\Roaming\AVG2012
2011-12-23 02:35:48 -------- d-----w- C:\Program Files (x86)\AVG
2011-12-23 02:31:45 -------- d--h--w- C:\ProgramData\Common Files
2011-12-23 02:31:29 -------- d-----w- C:\ProgramData\MFAData
2011-12-23 02:30:45 -------- d-----w- C:\Users\User\AppData\Local\Google
2011-12-23 02:30:33 -------- d-----w- C:\Users\User\AppData\Local\Apps
2011-12-23 02:30:32 -------- d-----w- C:\Users\User\AppData\Local\Deployment
2011-12-23 02:25:02 -------- d-----w- C:\Users\User\AppData\Local\AMD
2011-12-23 02:24:47 -------- d-----w- C:\Users\User\AppData\Local\ATI
2011-12-23 02:23:44 -------- d-----w- C:\Users\User\AppData\Roaming\Synaptics
2011-12-23 02:23:43 -------- d-----w- C:\Users\User\AppData\Roaming\hpqLog
2011-12-23 02:23:15 -------- d-----w- C:\Users\User\AppData\Local\VirtualStore
2011-12-23 02:13:57 -------- d-----w- C:\ProgramData\Synaptics
2011-12-23 02:05:41 -------- d-----w- C:\ProgramData\{D3B41B92-9BC2-43EB-916A-4FA9E8191837}
2011-12-23 02:05:22 404640 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2011-12-23 02:01:20 0 ----a-w- C:\Windows\ativpsrm.bin
2011-12-23 02:00:19 6382080 ----a-w- C:\Windows\System32\IDTNGUI.exe
2011-12-23 02:00:19 564224 ----a-w- C:\Windows\System32\idt64mp1.exe
2011-12-23 02:00:19 4933120 ----a-w- C:\Windows\System32\IDTNHP.dll
2011-12-23 02:00:19 4780032 ----a-w- C:\Windows\System32\stlang64.dll
2011-12-23 02:00:19 212480 ----a-w- C:\Windows\System32\IDTNJ.exe
2011-12-23 02:00:19 1523712 ----a-w- C:\Windows\System32\IDTNC64.cpl
2011-12-23 02:00:19 1128448 ----a-w- C:\Windows\sttray64.exe
2011-12-23 02:00:19 1029120 ----a-w- C:\Windows\System32\IDTNX.dll
2011-12-23 02:00:18 -------- d-----w- C:\Windows\System32\SRSLabs
2011-12-23 01:59:36 224256 ----a-w- C:\Windows\System32\staco64.dll
2011-12-23 01:59:35 654336 ------w- C:\Windows\System32\stapi64.dll
2011-12-23 01:59:35 528384 ----a-w- C:\Windows\System32\drivers\stwrt64.sys
2011-12-23 01:59:35 431616 ----a-w- C:\Windows\System32\stcplx64.dll
2011-12-23 01:59:35 1965056 ----a-w- C:\Windows\System32\in3stapo64.dll
2011-12-23 01:59:29 -------- d-----w- C:\Program Files\IDT
2011-12-23 01:59:26 -------- d-----w- C:\Windows\SysWow64\sda
2011-12-23 01:59:17 9888360 ----a-w- C:\Windows\SysWow64\RtsPStorIcon.dll
2011-12-23 01:59:17 338536 ----a-w- C:\Windows\System32\drivers\RtsPStor.sys
2011-12-23 01:58:32 74272 ----a-w- C:\Windows\System32\RtNicProp64.dll
2011-12-23 01:58:32 533096 ----a-w- C:\Windows\System32\drivers\Rt64win7.sys
2011-12-23 01:58:32 107552 ----a-w- C:\Windows\System32\RTNUninst64.dll
2011-12-23 01:58:29 -------- d-----w- C:\Program Files (x86)\Realtek
2011-12-23 01:58:16 -------- d-----w- C:\Program Files\Synaptics
2011-12-23 01:57:48 -------- d-----w- C:\Windows\Hewlett-Packard
2011-12-23 01:57:19 327008 ----a-w- C:\Windows\System32\RaCoInstx.dll
2011-12-23 01:57:19 1488448 ----a-w- C:\Windows\System32\drivers\netr28x.sys
2011-12-23 01:57:18 -------- d-----w- C:\ProgramData\Ralink Driver
2011-12-23 01:57:07 -------- d-----w- C:\Program Files\AMD
2011-12-23 01:57:07 -------- d-----w- C:\Program Files (x86)\AMD
2011-12-23 01:57:04 -------- d-----w- C:\Program Files (x86)\AMD APP
2011-12-23 01:57:00 -------- d-----w- C:\Program Files\Common Files\ATI Technologies
2011-12-23 01:57:00 -------- d-----w- C:\Program Files (x86)\Common Files\ATI Technologies
2011-12-23 01:56:08 46136 ----a-w- C:\Windows\System32\drivers\amdiox64.sys
2011-12-23 01:56:08 -------- d-----w- C:\ProgramData\AMD
2011-12-23 01:56:07 -------- d-----w- C:\Program Files\ATI Technologies
2011-12-23 01:56:00 47232 ----a-w- C:\Windows\System32\drivers\usbfilter.sys
2011-12-23 01:55:34 -------- d-----w- C:\Program Files\ATI
2011-12-23 01:55:32 -------- d-----w- C:\Program Files (x86)\ATI Technologies
2011-12-23 01:55:03 -------- d-sh--w- C:\Windows\Installer
2011-12-23 01:46:22 -------- d-----w- C:\Windows\ehome
.
==================== Find3M ====================
.
2011-11-28 18:01:25 41184 ----a-w- C:\Windows\avastSS.scr
2011-11-28 17:54:06 591192 ----a-w- C:\Windows\System32\drivers\aswSnx.sys
2011-11-28 17:52:11 66904 ----a-w- C:\Windows\System32\drivers\aswMonFlt.sys
2011-10-07 14:23:46 283728 ----a-w- C:\Windows\System32\drivers\avgldx64.sys
.
============= FINISH: 21:38:05.49 ===============

This post has been edited by Distressed Waif: 27 December 2011 - 02:16 AM

Hello and welcome to Bleeping Computer!

I am HelpBot: an automated program designed to help the Bleeping Computer Staff better assist you! This message contains very important information, so please read through all of it before doing anything.

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

To help Bleeping Computer better assist you please perform the following steps:

***************************************************

In order to continue receiving help at BleepingComputer.com, YOU MUST tell me if you still need help or if your issue has already been resolved on your own or through another resource! To tell me this, please click on the following link and follow the instructions there.

CLICK THIS LINK >>> http://www.bleepingcomputer.com/logreply/434701 <<< CLICK THIS LINK

If you no longer need help, then all you needed to do was the previous instructions of telling me so. You can skip the rest of this post. If you do need help please continue with Step 2 below.

***************************************************

If you still need help, I would like you to post a Reply to this topic (click the "Add Reply" button in the lower right hand of this page). In that reply, please include the following information:

• If you have not done so already, include a clear description of the problems you're having, along with any steps you may have performed so far.
  
• A new DDS and GMER log. For your convenience, you will find the instructions for generating these logs repeated at the bottom of this post.
  
  • Please do this even if you have previously posted logs for us.
    
  • If you were unable to produce the logs originally please try once more.
    
  • If you are unable to create a log please provide detailed information about your installed Windows Operating System including the Version, Edition and if it is a 32bit or a 64bit system.
    
  • If you are unsure about any of these characteristics just post what you can and we will guide you.
  
  
• Please tell us if you have your original Windows CD/DVD available.
  
• Upon completing the above steps and posting a reply, another staff member will review your topic and do their best to resolve your issues.

Thank you for your patience, and again sorry for the delay.

***************************************************

We need to see some information about what is happening in your machine. Please perform the following scan again:

• Download DDS by sUBs from one of the following links if you no longer have it available. Save it to your desktop.
  • DDS.scr
    
  • DDS.pif
  
  
• Double click on the DDS icon, allow it to run.
  
• A small box will open, with an explanation about the tool. No input is needed, the scan is running.
  
• Notepad will open with the results.
  
• Follow the instructions that pop up for posting the results.
  
• Close the program window, and delete the program from your desktop.

Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE


We also need a new log from the GMER anti-rootkit Scanner.

Please note that if you are running a 64-bit version of Windows you will not be able to run GMER and you may skip this step.

Please first disable any CD emulation programs using the steps found in this topic:


Then create another GMER log and post it as an attachment to the reply where you post your new DDS log. Instructions on how to properly create a GMER log can be found here:



As I am just a silly little program running on the BleepingComputer.com servers, please do not send me private messages as I do not know how to read and reply to them! Thanks!

Hello and Welcome to the forums!

My name is Gringo and I'll be glad to help you with your computer problems.

Somethings to remember while we are working together.

• Do not run any other tool untill instructed to do so!
  
• please Do not Attach logs or put in code boxes.
  
• Tell me about any problems that have occurred during the fix.
  
• Tell me of any other symptoms you may be having as these can help also.
  
• Do not run anything while running a fix.
  
• Do not run any other tool untill instructed to do so!

Click on the Watch Topic Button and select Immediate Notification and click on proceed, this will help you to get notified faster when I have replied and make the cleaning process faster.

Please print out or make a copy in notpad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

:multiple Anti Virus programs:

It looks like you are operating your computer with multiple Anti Virus programs running in memory at once:

AV: avast! Antivirus
AV: AVG Anti-Virus 2012

Anti-virus programs take up an enormous amount of your computer's resources when they are actively scanning your computer. Having two anti-virus programs running at the same time can cause your computer to run very slow, become unstable and even, in rare cases, crash.

Please remove all but one of them.

Run Combofix:

You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)

Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links.

Link 1
Link 2
Link 3

1. Close any open browsers or any other programs that are open.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you recieve an error "Illegal operation attempted on a registery key that has been marked for deletion." Please restart the computer

"information and logs"

In your next post I need the following


• Log from Combofix
  
• let me know of any problems you may have had
  
• How is the computer doing now?

Gringo

Edit: Oh, sorry Gringo I didn't see your post.

(before edit) Here is my log. I am worried about using any heavy duty stuff since my computer did not come with a boot disk and I didn't copy the recovery partition to a dvd in time. Do you know if rootkits hide in recovery partitions?

I am using Windows 7 Premium x64, so I can't run GMER. ;_;


.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 8.0.7601.17514
Run by User at 23:33:36 on 2012-01-03
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3563.1397 [GMT -8:00]
.
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
AV: AVG Anti-Virus 2012 *Enabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: AVG Anti-Virus 2012 *Enabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\PROGRA~2\AVG\AVG2012\avgrsa.exe
C:\Program Files (x86)\AVG\AVG2012\avgcsrva.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Program Files\IDT\WDM\STacSV64.exe
C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\atieclxx.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskhost.exe
C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Windows\Explorer.EXE
C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe
C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
c:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Program Files (x86)\AVG\AVG2012\AVGIDSAgent.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\IDT\WDM\sttray64.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files (x86)\AVG\AVG2012\avgnsa.exe
C:\Program Files (x86)\AVG\AVG2012\avgemca.exe
C:\Users\User\AppData\Roaming\Spotify\spotify.exe
C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
C:\Program Files (x86)\AVG\AVG2012\avgtray.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files (x86)\Acronis\DriveMonitor\adm_tray.exe
C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files (x86)\AVG\AVG2012\avgcsrva.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\wuauclt.exe
C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\taskhost.exe
C:\Windows\splwow64.exe
C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Foxit Software\Foxit Reader\Foxit Reader.exe
C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Microsoft Visual Studio 9.0\Common7\IDE\VCExpress.exe
C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\AVG\AVG2012\avgui.exe
C:\Program Files (x86)\AVG\AVG2012\avgcfgex.exe
C:\Windows\SysWOW64\ctfmon.exe
C:\Windows\System32\svchost.exe -k swprv
C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\conhost.exe
C:\Windows\SysWOW64\cscript.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uURLSearchHooks: H - No File
mWinlogon: Userinit=userinit.exe
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - C:\Program Files (x86)\AVG\AVG2012\avgssie.dll
BHO: {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - No File
BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
uRun: [Google Update] "C:\Users\User\AppData\Local\Google\Update\GoogleUpdate.exe" /c
uRun: [Spotify] "C:\Users\User\AppData\Roaming\Spotify\spotify.exe" /uri spotify:autostart
uRun: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized
mRun: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
mRun: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
mRun: [HPOSD] C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
mRun: [AVG_TRAY] "C:\Program Files (x86)\AVG\AVG2012\avgtray.exe"
mRun: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
mRun: [adm_tray.exe] C:\Program Files (x86)\Acronis\DriveMonitor\adm_tray.exe
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
TCP: DhcpNameServer = 172.16.42.1
TCP: Interfaces\{658633F3-3F97-41BA-A26F-A2AD752E9F03} : DhcpNameServer = 172.16.42.1
TCP: Interfaces\{658633F3-3F97-41BA-A26F-A2AD752E9F03}\361666560216D65627963616E6F6 : DhcpNameServer = 192.168.0.1
TCP: Interfaces\{658633F3-3F97-41BA-A26F-A2AD752E9F03}\45F6D6E445F6D6370235F6C6169627 : DhcpNameServer = 192.168.1.254
TCP: Interfaces\{658633F3-3F97-41BA-A26F-A2AD752E9F03}\94E435F4D4E49414 : DhcpNameServer = 10.0.15.1
TCP: Interfaces\{658633F3-3F97-41BA-A26F-A2AD752E9F03}\D62736F666665656 : DhcpNameServer = 66.75.164.89 66.75.164.90
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\AMD\SteadyVideo\VideoMIMEFilter.dll
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\AMD\SteadyVideo\VideoMIMEFilter.dll
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgpp.dll
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
BHO-X64: AVG Safe Search: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssie.dll
BHO-X64: WormRadar.com IESiteBlocker.NavFilter - No File
BHO-X64: {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - No File
BHO-X64: AMD SteadyVideo BHO - No File
BHO-X64: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
BHO-X64: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
BHO-X64: SkypeIEPluginBHO - No File
TB-X64: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
mRun-x64: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
mRun-x64: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
mRun-x64: [HPOSD] C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
mRun-x64: [AVG_TRAY] "C:\Program Files (x86)\AVG\AVG2012\avgtray.exe"
mRun-x64: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
mRun-x64: [adm_tray.exe] C:\Program Files (x86)\Acronis\DriveMonitor\adm_tray.exe
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\bqa8nu8h.default\
FF - plugin: C:\ProgramData\id Software\QuakeLive\npquakezero.dll
FF - plugin: C:\Users\User\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll
.
============= SERVICES / DRIVERS ===============
.
R0 amd_sata;amd_sata;C:\Windows\system32\DRIVERS\amd_sata.sys --> C:\Windows\system32\DRIVERS\amd_sata.sys [?]
R0 amd_xata;amd_xata;C:\Windows\system32\DRIVERS\amd_xata.sys --> C:\Windows\system32\DRIVERS\amd_xata.sys [?]
R0 AVGIDSEH;AVGIDSEH;C:\Windows\system32\DRIVERS\AVGIDSEH.Sys --> C:\Windows\system32\DRIVERS\AVGIDSEH.Sys [?]
R0 Avgrkx64;AVG Anti-Rootkit Driver;C:\Windows\system32\DRIVERS\avgrkx64.sys --> C:\Windows\system32\DRIVERS\avgrkx64.sys [?]
R1 aswSnx;aswSnx;C:\Windows\system32\drivers\aswSnx.sys --> C:\Windows\system32\drivers\aswSnx.sys [?]
R1 aswSP;aswSP;C:\Windows\system32\drivers\aswSP.sys --> C:\Windows\system32\drivers\aswSP.sys [?]
R1 Avgldx64;AVG AVI Loader Driver;C:\Windows\system32\DRIVERS\avgldx64.sys --> C:\Windows\system32\DRIVERS\avgldx64.sys [?]
R1 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;C:\Windows\system32\DRIVERS\avgmfx64.sys --> C:\Windows\system32\DRIVERS\avgmfx64.sys [?]
R1 Avgtdia;AVG TDI Driver;C:\Windows\system32\DRIVERS\avgtdia.sys --> C:\Windows\system32\DRIVERS\avgtdia.sys [?]
R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]
R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\system32\atiesrxx.exe --> C:\Windows\system32\atiesrxx.exe [?]
R2 AMD FUEL Service;AMD FUEL Service;C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2011-7-5 365568]
R2 aswFsBlk;aswFsBlk;C:\Windows\system32\drivers\aswFsBlk.sys --> C:\Windows\system32\drivers\aswFsBlk.sys [?]
R2 aswMonFlt;aswMonFlt;\??\C:\Windows\system32\drivers\aswMonFlt.sys --> C:\Windows\system32\drivers\aswMonFlt.sys [?]
R2 avast! Antivirus;avast! Antivirus;C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2011-12-22 44768]
R2 AVGIDSAgent;AVGIDSAgent;C:\Program Files (x86)\AVG\AVG2012\AVGIDSAgent.exe [2011-10-12 4433248]
R2 avgwd;AVG WatchDog;C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe [2011-8-2 192776]
R2 HP Support Assistant Service;HP Support Assistant Service;C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe [2011-6-21 85560]
R2 HPDrvMntSvc.exe;HP Quick Synchronization Service;C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-5-21 103992]
R2 HPWMISVC;HPWMISVC;C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2011-4-8 26680]
R2 IconMan_R;IconMan_R;C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [2011-12-22 2375168]
R3 amdiox64;AMD IO Driver;C:\Windows\system32\DRIVERS\amdiox64.sys --> C:\Windows\system32\DRIVERS\amdiox64.sys [?]
R3 amdkmdag;amdkmdag;C:\Windows\system32\DRIVERS\atikmdag.sys --> C:\Windows\system32\DRIVERS\atikmdag.sys [?]
R3 amdkmdap;amdkmdap;C:\Windows\system32\DRIVERS\atikmpag.sys --> C:\Windows\system32\DRIVERS\atikmpag.sys [?]
R3 AtiHDAudioService;ATI Function Driver for HD Audio Service;C:\Windows\system32\drivers\AtihdW76.sys --> C:\Windows\system32\drivers\AtihdW76.sys [?]
R3 AVGIDSDriver;AVGIDSDriver;C:\Windows\system32\DRIVERS\AVGIDSDriver.Sys --> C:\Windows\system32\DRIVERS\AVGIDSDriver.Sys [?]
R3 AVGIDSFilter;AVGIDSFilter;C:\Windows\system32\DRIVERS\AVGIDSFilter.Sys --> C:\Windows\system32\DRIVERS\AVGIDSFilter.Sys [?]
R3 clwvd;CyberLink WebCam Virtual Driver;C:\Windows\system32\DRIVERS\clwvd.sys --> C:\Windows\system32\DRIVERS\clwvd.sys [?]
R3 netr28x;Ralink 802.11n Extensible Wireless Driver;C:\Windows\system32\DRIVERS\netr28x.sys --> C:\Windows\system32\DRIVERS\netr28x.sys [?]
R3 RSPCIESTOR;Realtek PCIE CardReader Driver;C:\Windows\system32\DRIVERS\RtsPStor.sys --> C:\Windows\system32\DRIVERS\RtsPStor.sys [?]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]
R3 usbfilter;AMD USB Filter Driver;C:\Windows\system32\DRIVERS\usbfilter.sys --> C:\Windows\system32\DRIVERS\usbfilter.sys [?]
S3 SrvHsfHDA;SrvHsfHDA;C:\Windows\system32\DRIVERS\VSTAZL6.SYS --> C:\Windows\system32\DRIVERS\VSTAZL6.SYS [?]
S3 SrvHsfV92;SrvHsfV92;C:\Windows\system32\DRIVERS\VSTDPV6.SYS --> C:\Windows\system32\DRIVERS\VSTDPV6.SYS [?]
S3 SrvHsfWinac;SrvHsfWinac;C:\Windows\system32\DRIVERS\VSTCNXT6.SYS --> C:\Windows\system32\DRIVERS\VSTCNXT6.SYS [?]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]
S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\system32\drivers\TsUsbGD.sys --> C:\Windows\system32\drivers\TsUsbGD.sys [?]
S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;C:\Program Files (x86)\Microsoft SQL Server\100\Shared\sqladhlp.exe [2008-7-10 47128]
S4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);C:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [2008-7-10 369688]
.
=============== Created Last 30 ================
.
2012-01-03 10:00:14 -------- d-----w- C:\Users\User\AppData\Local\Mozilla
2012-01-02 05:33:59 -------- d-----w- C:\Users\User\AppData\Local\CyberLink
2012-01-02 05:32:28 -------- d-----r- C:\Program Files (x86)\Skype
2012-01-01 22:09:45 -------- d-----w- C:\Users\User\AppData\Roaming\IrfanView
2012-01-01 22:09:44 -------- d-----w- C:\Program Files (x86)\IrfanView
2011-12-30 05:49:35 -------- d-----w- C:\ProgramData\id Software
2011-12-28 11:08:13 -------- d-----w- C:\Program Files (x86)\Foxit Software
2011-12-28 09:24:15 -------- d-----w- C:\Program Files (x86)\Conduit
2011-12-28 09:24:12 -------- d-----w- C:\Users\User\AppData\Local\Conduit
2011-12-28 09:24:03 -------- d-----w- C:\Program Files (x86)\uTorrent
2011-12-28 09:23:07 -------- d-----w- C:\Users\User\AppData\Roaming\uTorrent
2011-12-24 05:43:40 -------- d-----w- C:\Users\User\AppData\Local\Hewlett-Packard
2011-12-23 05:20:30 388096 ----a-r- C:\Users\User\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-12-23 05:20:29 -------- d-----w- C:\Program Files (x86)\Trend Micro
2011-12-23 03:27:51 50200 ----a-w- C:\Windows\SysWow64\perf-SQLAgent$SQLEXPRESS-sqlagtctr10.0.1600.22.dll
2011-12-23 03:27:39 79896 ----a-w- C:\Windows\SysWow64\perf-MSSQL$SQLEXPRESS-sqlctr10.0.1600.22.dll
2011-12-23 03:26:07 -------- d-----w- C:\Windows\SysWow64\1033
2011-12-23 03:26:07 -------- d-----w- C:\Windows\System32\1033
2011-12-23 03:26:07 -------- d-----w- C:\Program Files\Microsoft SQL Server
2011-12-23 03:23:40 -------- d-----w- C:\Program Files (x86)\Microsoft SQL Server
2011-12-23 03:22:51 -------- d-----w- C:\Users\User\AppData\Local\Microsoft Help
2011-12-23 03:20:32 -------- d-----w- C:\Program Files (x86)\Common Files\Merge Modules
2011-12-23 03:12:15 -------- d--h--w- C:\$AVG
2011-12-23 02:58:18 -------- d-----w- C:\Users\User\AppData\Local\Spotify
2011-12-23 02:57:42 -------- d-----w- C:\Users\User\AppData\Roaming\Spotify
2011-12-23 02:54:09 -------- d-----w- C:\Users\User\AppData\Local\Diagnostics
2011-12-23 02:53:39 -------- d-----w- C:\Users\User\AppData\Roaming\AVG2012
2011-12-23 02:35:48 -------- d-----w- C:\Program Files (x86)\AVG
2011-12-23 02:31:45 -------- d--h--w- C:\ProgramData\Common Files
2011-12-23 02:31:29 -------- d-----w- C:\ProgramData\MFAData
2011-12-23 02:30:45 -------- d-----w- C:\Users\User\AppData\Local\Google
2011-12-23 02:30:33 -------- d-----w- C:\Users\User\AppData\Local\Apps
2011-12-23 02:30:32 -------- d-----w- C:\Users\User\AppData\Local\Deployment
2011-12-23 02:25:02 -------- d-----w- C:\Users\User\AppData\Local\AMD
2011-12-23 02:24:47 -------- d-----w- C:\Users\User\AppData\Local\ATI
2011-12-23 02:23:44 -------- d-----w- C:\Users\User\AppData\Roaming\Synaptics
2011-12-23 02:23:43 -------- d-----w- C:\Users\User\AppData\Roaming\hpqLog
2011-12-23 02:23:15 -------- d-----w- C:\Users\User\AppData\Local\VirtualStore
2011-12-23 02:13:57 -------- d-----w- C:\ProgramData\Synaptics
2011-12-23 02:05:41 -------- d-----w- C:\ProgramData\{D3B41B92-9BC2-43EB-916A-4FA9E8191837}
2011-12-23 02:05:22 404640 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2011-12-23 02:01:20 0 ----a-w- C:\Windows\ativpsrm.bin
2011-12-23 02:00:19 6382080 ----a-w- C:\Windows\System32\IDTNGUI.exe
2011-12-23 02:00:19 564224 ----a-w- C:\Windows\System32\idt64mp1.exe
2011-12-23 02:00:19 4933120 ----a-w- C:\Windows\System32\IDTNHP.dll
2011-12-23 02:00:19 4780032 ----a-w- C:\Windows\System32\stlang64.dll
2011-12-23 02:00:19 212480 ----a-w- C:\Windows\System32\IDTNJ.exe
2011-12-23 02:00:19 1523712 ----a-w- C:\Windows\System32\IDTNC64.cpl
2011-12-23 02:00:19 1128448 ----a-w- C:\Windows\sttray64.exe
2011-12-23 02:00:19 1029120 ----a-w- C:\Windows\System32\IDTNX.dll
2011-12-23 02:00:18 -------- d-----w- C:\Windows\System32\SRSLabs
2011-12-23 01:59:36 224256 ----a-w- C:\Windows\System32\staco64.dll
2011-12-23 01:59:35 654336 ------w- C:\Windows\System32\stapi64.dll
2011-12-23 01:59:35 528384 ----a-w- C:\Windows\System32\drivers\stwrt64.sys
2011-12-23 01:59:35 431616 ----a-w- C:\Windows\System32\stcplx64.dll
2011-12-23 01:59:35 1965056 ----a-w- C:\Windows\System32\stapo64.dll
2011-12-23 01:59:29 -------- d-----w- C:\Program Files\IDT
2011-12-23 01:59:26 -------- d-----w- C:\Windows\SysWow64\sda
2011-12-23 01:59:17 9888360 ----a-w- C:\Windows\SysWow64\RtsPStorIcon.dll
2011-12-23 01:59:17 338536 ----a-w- C:\Windows\System32\drivers\RtsPStor.sys
2011-12-23 01:58:32 74272 ----a-w- C:\Windows\System32\RtNicProp64.dll
2011-12-23 01:58:32 533096 ----a-w- C:\Windows\System32\drivers\Rt64win7.sys
2011-12-23 01:58:32 107552 ----a-w- C:\Windows\System32\RTNUninst64.dll
2011-12-23 01:58:29 -------- d-----w- C:\Program Files (x86)\Realtek
2011-12-23 01:58:16 -------- d-----w- C:\Program Files\Synaptics
2011-12-23 01:57:48 -------- d-----w- C:\Windows\Hewlett-Packard
2011-12-23 01:57:19 327008 ----a-w- C:\Windows\System32\RaCoInstx.dll
2011-12-23 01:57:19 1488448 ----a-w- C:\Windows\System32\drivers\netr28x.sys
2011-12-23 01:57:18 -------- d-----w- C:\ProgramData\Ralink Driver
2011-12-23 01:57:07 -------- d-----w- C:\Program Files\AMD
2011-12-23 01:57:07 -------- d-----w- C:\Program Files (x86)\AMD
2011-12-23 01:57:04 -------- d-----w- C:\Program Files (x86)\AMD APP
2011-12-23 01:57:00 -------- d-----w- C:\Program Files\Common Files\ATI Technologies
2011-12-23 01:57:00 -------- d-----w- C:\Program Files (x86)\Common Files\ATI Technologies
2011-12-23 01:56:08 46136 ----a-w- C:\Windows\System32\drivers\amdiox64.sys
2011-12-23 01:56:08 -------- d-----w- C:\ProgramData\AMD
2011-12-23 01:56:07 -------- d-----w- C:\Program Files\ATI Technologies
2011-12-23 01:56:00 47232 ----a-w- C:\Windows\System32\drivers\usbfilter.sys
2011-12-23 01:55:34 -------- d-----w- C:\Program Files\ATI
2011-12-23 01:55:32 -------- d-----w- C:\Program Files (x86)\ATI Technologies
2011-12-23 01:55:03 -------- d-sh--w- C:\Windows\Installer
2011-12-23 01:46:22 -------- d-----w- C:\Windows\ehome
.
==================== Find3M ====================
.
2011-11-28 18:01:25 41184 ----a-w- C:\Windows\avastSS.scr
2011-11-28 17:54:06 591192 ----a-w- C:\Windows\System32\drivers\aswSnx.sys
2011-11-28 17:52:11 66904 ----a-w- C:\Windows\System32\drivers\aswMonFlt.sys
2011-10-07 14:23:46 283728 ----a-w- C:\Windows\System32\drivers\avgldx64.sys
.
============= FINISH: 23:34:17.12 ===============

This post has been edited by Distressed Waif: 04 January 2012 - 02:42 AM

Hello

that is OK go ahead and run combofix for me now


gringo

Hello

48 Hour bump

It has been more than 48 hours since my last post.

• do you still need help with this?
  
• do you need more time?
  
• are you having problems following my instructions?
  
• if after 48hrs you have not replied to this thread then it will have to be closed!

Gringo

Sorry, I've been extremely ill. Okay, may be not extreme, but very, very ill. I just stopped in to pick something up. I will post the combofix log soon.

Sorry to hear you are feeling bad - if you need more time just let me know and we can do this in a couple of days


gringo

Yeah, I feel awful. Massive fatigue. My body might have a rootkit, one of the crappy ones you die from. Ahah. : (

AVG has not found any more rootkit viruses. I wonder if it's definite? Are there any other scans I have to execute?

I have a number of hard disks that are infected, as well as a laptop that wont start, and has a hacked administrator password. Is there any way to clear those, as well?



ComboFix 12-01-11.01 - User 01/12/2012 1:01.3.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3563.2547 [GMT -8:00]
Running from: c:\users\User\Desktop\ComboFix.exe
AV: AVG Anti-Virus 2012 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
SP: AVG Anti-Virus 2012 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-- Previous Run --
.
c:\windows\SysWow64\drivers\ntfs.sys . . . is infected!!
.
--------
.
.
((((((((((((((((((((((((( Files Created from 2011-12-12 to 2012-01-12 )))))))))))))))))))))))))))))))
.
.
2012-01-12 09:10 . 2012-01-12 09:10 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-01-02 05:34 . 2012-01-02 05:36 -------- d-----w- c:\programdata\CyberLink
2012-01-02 05:32 . 2012-01-02 05:32 -------- d-----w- c:\program files (x86)\Common Files\Skype
2012-01-02 05:32 . 2012-01-02 05:34 -------- d-----r- c:\program files (x86)\Skype
2012-01-02 05:32 . 2012-01-02 05:32 -------- d-----w- c:\programdata\Skype
2012-01-01 22:09 . 2012-01-01 22:09 -------- d-----w- c:\program files (x86)\IrfanView
2011-12-30 05:49 . 2011-12-30 05:49 -------- d-----w- c:\programdata\id Software
2011-12-28 11:08 . 2011-12-28 11:08 -------- d-----w- c:\program files (x86)\Foxit Software
2011-12-28 09:24 . 2011-12-28 09:24 -------- d-----w- c:\program files (x86)\Conduit
2011-12-28 09:24 . 2011-12-28 09:24 -------- d-----w- c:\program files (x86)\uTorrent
2011-12-27 04:48 . 2012-01-04 07:14 -------- d-----w- c:\program files (x86)\Notepad++
2011-12-24 05:37 . 2011-12-24 05:37 -------- d-----w- c:\program files (x86)\Common Files\Acronis
2011-12-24 05:37 . 2011-12-24 05:37 -------- d-----w- c:\program files (x86)\Acronis
2011-12-23 05:20 . 2011-12-23 05:20 -------- d-----w- c:\program files (x86)\Trend Micro
2011-12-23 03:27 . 2008-07-11 00:33 50200 ----a-w- c:\windows\SysWow64\perf-SQLAgent$SQLEXPRESS-sqlagtctr10.0.1600.22.dll
2011-12-23 03:27 . 2008-07-11 00:33 79896 ----a-w- c:\windows\SysWow64\perf-MSSQL$SQLEXPRESS-sqlctr10.0.1600.22.dll
2011-12-23 03:26 . 2011-12-23 03:26 -------- d-----w- c:\program files\Microsoft SQL Server
2011-12-23 03:26 . 2011-12-23 03:26 -------- d-----w- c:\windows\SysWow64\1033
2011-12-23 03:26 . 2011-12-23 03:26 -------- d-----w- c:\windows\system32\1033
2011-12-23 03:23 . 2011-12-23 03:27 -------- d-----w- c:\program files (x86)\Microsoft SQL Server
2011-12-23 03:23 . 2011-12-23 03:23 -------- d-----w- c:\program files (x86)\Microsoft Silverlight
2011-12-23 03:20 . 2011-12-23 03:25 -------- d-----w- c:\program files (x86)\Microsoft.NET
2011-12-23 03:20 . 2011-12-23 03:23 -------- d-----w- c:\programdata\Microsoft Help
2011-12-23 03:20 . 2011-12-23 03:22 -------- d-----w- c:\program files (x86)\Microsoft Visual Studio 9.0
2011-12-23 03:20 . 2011-12-23 03:21 -------- d-----w- c:\program files (x86)\Common Files\Merge Modules
2011-12-23 03:19 . 2011-12-23 03:19 -------- d-----w- c:\program files\Microsoft SDKs
2011-12-23 03:19 . 2011-12-23 03:19 -------- d-----w- c:\program files\Microsoft Visual Studio 9.0
2011-12-23 03:12 . 2011-12-23 03:12 -------- d-----w- C:\$AVG
2011-12-23 02:36 . 2011-11-28 18:01 256960 ----a-w- c:\windows\system32\aswBoot.exe
2011-12-23 02:36 . 2011-12-23 02:36 -------- d-----w- c:\windows\SysWow64\drivers\AVG
2011-12-23 02:36 . 2012-01-11 20:45 -------- d-----w- c:\programdata\AVAST Software
2011-12-23 02:36 . 2011-12-23 02:36 -------- d-----w- c:\program files\AVAST Software
2011-12-23 02:36 . 2012-01-12 01:15 -------- d-----w- c:\windows\system32\drivers\AVG
2011-12-23 02:36 . 2011-12-23 03:07 -------- d-----w- c:\programdata\AVG2012
2011-12-23 02:35 . 2011-12-23 02:35 -------- d-----w- c:\program files (x86)\AVG
2011-12-23 02:31 . 2011-12-23 02:31 -------- d--h--w- c:\programdata\Common Files
2011-12-23 02:31 . 2012-01-12 01:16 -------- d-----w- c:\programdata\MFAData
2011-12-23 02:22 . 2011-12-23 02:23 -------- d-----w- c:\users\User
2011-12-23 02:14 . 2011-12-23 02:14 -------- d-----w- c:\programdata\ATI
2011-12-23 02:13 . 2011-12-23 02:13 -------- d-----w- c:\programdata\Synaptics
2011-12-23 02:05 . 2011-12-23 02:05 -------- d-----w- c:\programdata\{D3B41B92-9BC2-43EB-916A-4FA9E8191837}
2011-12-23 02:05 . 2011-12-23 02:05 404640 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-12-23 02:05 . 2011-12-23 02:05 -------- d-----w- c:\windows\SysWow64\Macromed
2011-12-23 02:03 . 2011-12-23 02:03 -------- d-----w- c:\program files (x86)\CyberLink
2011-12-23 02:01 . 2011-12-23 02:01 0 ----a-w- c:\windows\ativpsrm.bin
2011-12-23 02:00 . 2011-06-08 19:58 4780032 ----a-w- c:\windows\system32\stlang64.dll
2011-12-23 02:00 . 2011-06-08 19:58 1128448 ----a-w- c:\windows\sttray64.exe
2011-12-23 01:59 . 2011-12-23 01:59 -------- d-----w- c:\windows\SysWow64\sda
2011-12-23 01:59 . 2011-04-08 19:25 9888360 ----a-w- c:\windows\SysWow64\RtsPStorIcon.dll
2011-12-23 01:59 . 2011-04-08 19:25 338536 ----a-w- c:\windows\system32\drivers\RtsPStor.sys
2011-12-23 01:58 . 2011-05-25 16:55 74272 ----a-w- c:\windows\system32\RtNicProp64.dll
2011-12-23 01:58 . 2011-05-25 16:55 533096 ----a-w- c:\windows\system32\drivers\Rt64win7.sys
2011-12-23 01:58 . 2011-05-25 16:55 107552 ----a-w- c:\windows\system32\RTNUninst64.dll
2011-12-23 01:58 . 2011-12-23 01:59 -------- d-----w- c:\program files (x86)\Realtek
2011-12-23 01:58 . 2011-12-23 01:58 -------- d-----w- c:\program files\Synaptics
2011-12-23 01:57 . 2011-12-23 02:02 -------- d-----w- c:\windows\Hewlett-Packard
2011-12-23 01:57 . 2011-12-23 02:13 -------- d-----w- c:\programdata\Hewlett-Packard
2011-12-23 01:57 . 2011-04-19 19:32 1488448 ----a-w- c:\windows\system32\drivers\netr28x.sys
2011-12-23 01:57 . 2011-04-15 21:53 327008 ----a-w- c:\windows\system32\RaCoInstx.dll
2011-12-23 01:57 . 2011-12-23 02:07 -------- d--h--w- c:\program files (x86)\InstallShield Installation Information
2011-12-23 01:57 . 2011-12-23 01:57 -------- d-----w- c:\programdata\Ralink Driver
2011-12-23 01:57 . 2011-12-23 01:57 -------- d-----w- c:\program files\AMD
2011-12-23 01:57 . 2011-12-23 01:57 -------- d-----w- c:\program files (x86)\AMD
2011-12-23 01:57 . 2011-12-23 01:57 -------- d-----w- c:\program files (x86)\AMD APP
2011-12-23 01:57 . 2011-12-23 01:57 -------- d-----w- c:\program files\Common Files\ATI Technologies
2011-12-23 01:57 . 2011-12-23 01:57 -------- d-----w- c:\program files (x86)\Common Files\ATI Technologies
2011-12-23 01:56 . 2011-12-23 01:56 -------- d-----w- c:\programdata\AMD
2011-12-23 01:56 . 2010-02-18 17:18 46136 ----a-w- c:\windows\system32\drivers\amdiox64.sys
2011-12-23 01:56 . 2011-12-23 01:56 -------- d-----w- c:\program files\ATI Technologies
2011-12-23 01:56 . 2011-12-23 01:56 -------- dc----w- c:\windows\system32\DRVSTORE
2011-12-23 01:56 . 2010-12-16 19:06 47232 ----a-w- c:\windows\system32\drivers\usbfilter.sys
2011-12-23 01:55 . 2011-12-23 01:55 -------- d-----w- c:\program files\ATI
2011-12-23 01:55 . 2011-12-23 01:56 -------- d-----w- c:\program files (x86)\ATI Technologies
2011-12-23 01:55 . 2011-12-23 02:06 -------- d-----w- c:\program files (x86)\Hewlett-Packard
2011-12-23 01:55 . 2012-01-02 05:34 -------- d-sh--w- c:\windows\Installer
2011-12-23 01:46 . 2012-01-09 07:59 -------- d-----r- c:\users\Public\Recorded TV
2011-12-23 01:46 . 2011-12-23 01:46 -------- d-----w- c:\windows\ehome
2011-12-23 01:46 . 2011-12-23 01:46 -------- d-----w- c:\users\Default\AppData\Roaming\Media Center Programs
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Spotify"="c:\users\User\AppData\Roaming\Spotify\spotify.exe" [2012-01-12 4001456]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2011-10-13 19979400]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-07-05 336384]
"HP Quick Launch"="c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe" [2011-04-08 586808]
"HPOSD"="c:\program files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe" [2011-06-14 336440]
"AVG_TRAY"="c:\program files (x86)\AVG\AVG2012\avgtray.exe" [2011-12-03 2415456]
"adm_tray.exe"="c:\program files (x86)\Acronis\DriveMonitor\adm_tray.exe" [2011-02-25 466768]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~2\AVG\AVG2012\avgrsa.exe /sync /restart
.
R2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [2011-06-21 85560]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [x]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [x]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x]
R4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files (x86)\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [2008-07-11 47128]
R4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [2008-07-11 369688]
S0 amd_sata;amd_sata;c:\windows\system32\DRIVERS\amd_sata.sys [x]
S0 amd_xata;amd_xata;c:\windows\system32\DRIVERS\amd_xata.sys [x]
S0 AVGIDSEH;AVGIDSEH;c:\windows\system32\DRIVERS\AVGIDSEH.Sys [x]
S0 Avgrkx64;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx64.sys [x]
S1 Avgldx64;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx64.sys [x]
S1 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\DRIVERS\avgmfx64.sys [x]
S1 Avgtdia;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdia.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2011-07-05 365568]
S2 AVGIDSAgent;AVGIDSAgent;c:\program files (x86)\AVG\AVG2012\AVGIDSAgent.exe [2011-10-12 4433248]
S2 avgwd;AVG WatchDog;c:\program files (x86)\AVG\AVG2012\avgwdsvc.exe [2011-08-02 192776]
S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-05-22 103992]
S2 HPWMISVC;HPWMISVC;c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2011-04-08 26680]
S2 IconMan_R;IconMan_R;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [2011-03-08 2375168]
S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys [x]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [x]
S3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\AVGIDSDriver.Sys [x]
S3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\AVGIDSFilter.Sys [x]
S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys [x]
S3 netr28x;Ralink 802.11n Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr28x.sys [x]
S3 RSPCIESTOR;Realtek PCIE CardReader Driver;c:\windows\system32\DRIVERS\RtsPStor.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [x]
.
.
Contents of the 'Scheduled Tasks' folder
.
2012-01-11 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1093665588-3991667852-2866185048-1001Core.job
- c:\users\User\AppData\Local\Google\Update\GoogleUpdate.exe [2011-12-23 02:30]
.
2012-01-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1093665588-3991667852-2866185048-1001UA.job
- c:\users\User\AppData\Local\Google\Update\GoogleUpdate.exe [2011-12-23 02:30]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6C680BAE-655C-4E3D-8FC4-E6A520C3D928}]
2011-06-07 23:30 81024 ----a-w- c:\program files\AMD\SteadyVideo\SteadyVideo.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2011-06-08 1128448]
"SetDefault"="c:\program files\Hewlett-Packard\HP LaunchBox\SetDefault.exe" [2011-06-28 42808]
"Acronis Scheduler2 Service"="c:\program files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe" [2011-02-12 462400]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: DhcpNameServer = 172.16.42.1
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - c:\program files (x86)\AMD\SteadyVideo\VideoMIMEFilter.dll
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - c:\program files (x86)\AMD\SteadyVideo\VideoMIMEFilter.dll
FF - ProfilePath - c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\bqa8nu8h.default\
.
- - - - ORPHANS REMOVED - - - -
.
URLSearchHooks-{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - (no file)
BHO-{6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
AddRemove-{CA43FE4F-9FF2-4AD7-88F0-CC3BAC17B226} - c:\program files (x86)\InstallShield Installation Information\{CA43FE4F-9FF2-4AD7-88F0-CC3BAC17B226}\setup.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10q_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10q_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10q.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10q.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10q.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10q.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe
c:\program files (x86)\CyberLink\YouCam\YCMMirage.exe
.
**************************************************************************
.
Completion time: 2012-01-12 01:27:42 - machine was rebooted
ComboFix-quarantined-files.txt 2012-01-12 09:27
.
Pre-Run: 446,599,974,912 bytes free
Post-Run: 446,484,791,296 bytes free
.
- - End Of File - - CE1CBF8F761F996139F630EC693BD9D2

Hello


Tell me about the harddrives


SystemLook:

Please download SystemLook from one of the links below and save it to your Desktop.

Link 1
Link 2

• Double-click SystemLook.exe to run it.
  
• Copy the content of the following codebox into the main textfield:

:filefind
ntfs.sys

• Click the Look button to start the scan.
  
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

They're just regular hard drive disks, that I'm pretty certain contain the virus. I'm not sure how to wipe the virus off of them, or my other laptop's bios. That machine is so damaged I can't even access the Windows Recovery because the admin password changed, when I never even assigned one. : [



SystemLook 30.07.11 by jpshortstuff
Log created at 15:21 on 13/01/2012 by User
Administrator - Elevation successful

========== filefind ==========

Searching for "ntfs.sys"
C:\Windows\ERDNT\cache64\ntfs.sys --a---- 1659776 bytes [09:23 12/01/2012] [04:12 21/07/2011] A2F74975097F52A00745F9637451FDD8
C:\Windows\System32\drivers\ntfs.sys --a---- 1659776 bytes [04:12 21/07/2011] [04:12 21/07/2011] A2F74975097F52A00745F9637451FDD8
C:\Windows\winsxs\amd64_microsoft-windows-ntfs_31bf3856ad364e35_6.1.7601.17514_none_04972f2c338b23d4\ntfs.sys --a---- 1659776 bytes [03:23 21/11/2010] [03:23 21/11/2010] 05D78AA5CB5F3F5C31160BDB955D0B7C
C:\Windows\winsxs\amd64_microsoft-windows-ntfs_31bf3856ad364e35_6.1.7601.17577_none_0459508233b9177f\ntfs.sys --a---- 1659776 bytes [04:12 21/07/2011] [04:12 21/07/2011] A2F74975097F52A00745F9637451FDD8
C:\Windows\winsxs\amd64_microsoft-windows-ntfs_31bf3856ad364e35_6.1.7601.21680_none_04d11b5b4ce521d9\ntfs.sys --a---- 1659776 bytes [04:12 21/07/2011] [04:12 21/07/2011] 87B104128D4D3BA3C13098BAEBF38082

-= EOF =-




AVG doesn't detect anything, right now, though when I was performing an anti-rootkit scan my computer froze near the start of it.

Greetings

the harddrive I would scan with your on board antivirus

the laptop I don't think I can help with but I may be able to help remove any files that you would like to keep



:Run CFScript:

Open Notepad and copy/paste the text in the box into the window:

 ClearJavaCache:: 

Save it to your desktop as CFScript.txt

Refering to the picture above, drag CFScript.txt into ComboFix.exe

This will let ComboFix run again.
Restart if you have to.
Save the produced logfile to your desktop.

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

"information and logs"

In your next post I need the following


• report from Combofix
  
• let me know of any problems you may have had
  
• How is the computer doing now after running the script?

Gringo

Hello

48 Hour bump

It has been more than 48 hours since my last post.

• do you still need help with this?
  
• do you need more time?
  
• are you having problems following my instructions?
  
• if after 48hrs you have not replied to this thread then it will have to be closed!

Gringo

Due to the lack of feedback, this topic is now closed.

In the event you still have problems, please send me or any Moderator a Private Message and ask them to reopen this topic within the next 5 days. Please include a link to your topic in the Private Message. Thank you.