BleepingComputer.com: Trojan Downloader?

Hi. I'd like to start off with telling you that I am not much of a computer whiz to know how to fix it, but I do know enough to know that there was something wrong. It starts off with when I play my computer games, whether it be from steam games or even my sims 3..I'll be playing for maybe 20-30 mins in and then it sort of just crashes. I get black screen for awhile (long enough that I can't wait and I end up manually ending the game through task manger) with my mouse & keyboard still usable that I can hit desktop on keyboard. I started paying close attention to event logs (just found out about that recently) and notice that there are quite a few errors and warnings on there..some were leading me to think it was due to my router as we have had lost connections alot in the past few months, so we knew it was going to need to be replaced. So we bought a new router and it did solve that from happening. Then the next day when trying to play the games as mentioned before I started getting messages that my paged pool memory minimum was too low and that it was making it higher, but it would make the game crash as well. So, I decided to check for bad things on the computer. AVG Free Edition 2012,and MalwareBytes found nothing. So, I downloaded SuperAntispyware & it found 166 tracking cookies and removed them, but still happening. So I then decided to download and try Hijack this & it found some things that sounded suspicious to me and I decided to look them up on the net, and I found that there is a Trojan Downloader on my computer. I also have gone and tried all those programs in safe mode (except for hijack this) and they found nothing, but AVG did let me know that there was 34 locked files and 1 corrupted executeable file that it couldn't scan. There was also 1 warning but it didn't show me the warning. Also, I know I don't have a problem with not enough ram or anything like that because I have ran everything without problems before this. Please help, as I have been trying to research this situation for about 2 weeks now, but have been afraid to really try to do anything else on my own as I don't want to screw anything up & was trying to avoid having to bother you guys as I know how busy you all are. It's also at the point that I receive that low virtual memory while only searching on the net even when its only for maybe 5 minutes. Thanks in advance, for any help is much appreciated!

This post has been edited by LatinSweetheart: 10 January 2012 - 02:47 PM

I just started my pc a few minutes ago. My daily pc routine is to always start with CCleaner..well as soon as I started it, my AVG Resident Shield window popped open and it says there are 2 infections that were tracking cookies, 1 of them was called something like Atdmt. Please help me, not sure what is going on...How are they getting in past my avg and za firewall if I have been barely doing anything on the pc since this all started.

Hello and welcome to Bleeping Computer!

I am HelpBot: an automated program designed to help the Bleeping Computer Staff better assist you! This message contains very important information, so please read through all of it before doing anything.

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

To help Bleeping Computer better assist you please perform the following steps:

***************************************************

In order to continue receiving help at BleepingComputer.com, YOU MUST tell me if you still need help or if your issue has already been resolved on your own or through another resource! To tell me this, please click on the following link and follow the instructions there.

CLICK THIS LINK >>> http://www.bleepingcomputer.com/logreply/437229 <<< CLICK THIS LINK

If you no longer need help, then all you needed to do was the previous instructions of telling me so. You can skip the rest of this post. If you do need help please continue with Step 2 below.

***************************************************

If you still need help, I would like you to post a Reply to this topic (click the "Add Reply" button in the lower right hand of this page). In that reply, please include the following information:

• If you have not done so already, include a clear description of the problems you're having, along with any steps you may have performed so far.
  
• A new DDS and GMER log. For your convenience, you will find the instructions for generating these logs repeated at the bottom of this post.
  
  • Please do this even if you have previously posted logs for us.
    
  • If you were unable to produce the logs originally please try once more.
    
  • If you are unable to create a log please provide detailed information about your installed Windows Operating System including the Version, Edition and if it is a 32bit or a 64bit system.
    
  • If you are unsure about any of these characteristics just post what you can and we will guide you.
  
  
• Please tell us if you have your original Windows CD/DVD available.
  
• Upon completing the above steps and posting a reply, another staff member will review your topic and do their best to resolve your issues.

Thank you for your patience, and again sorry for the delay.

***************************************************

We need to see some information about what is happening in your machine. Please perform the following scan again:

• Download DDS by sUBs from one of the following links if you no longer have it available. Save it to your desktop.
  • DDS.scr
    
  • DDS.pif
  
  
• Double click on the DDS icon, allow it to run.
  
• A small box will open, with an explanation about the tool. No input is needed, the scan is running.
  
• Notepad will open with the results.
  
• Follow the instructions that pop up for posting the results.
  
• Close the program window, and delete the program from your desktop.

Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE


We also need a new log from the GMER anti-rootkit Scanner.

Please note that if you are running a 64-bit version of Windows you will not be able to run GMER and you may skip this step.

Please first disable any CD emulation programs using the steps found in this topic:


Then create another GMER log and post it as an attachment to the reply where you post your new DDS log. Instructions on how to properly create a GMER log can be found here:



As I am just a silly little program running on the BleepingComputer.com servers, please do not send me private messages as I do not know how to read and reply to them! Thanks!

.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_30
Run by Owner at 23:30:24 on 2012-01-16
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3326.2838 [GMT -5:00]
.
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: ZoneAlarm Free Firewall *Disabled*
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
C:\WINDOWS\system32\svchost.exe -k hpdevmgmt
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\Program Files\Razer\DeathAdder\razerhid.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\Program Files\AVAST Software\Avast\avastUI.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\system32\ScsiAccess.EXE
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\UPHClean\uphclean.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\Razer\DeathAdder\razertra.exe
C:\Program Files\Razer\DeathAdder\razerofa.exe
C:\Program Files\Razer\DeathAdder\vdDaemon.exe
C:\WINDOWS\system32\wscntfy.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.yahoo.com/?fr=fp-yie8
uWindow Title = Windows Internet Explorer provided by Yahoo!
uDefault_Page_URL = hxxp://www.yahoo.com/?fr=fp-yie8
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = localhost
uURLSearchHooks: DeviceVM Url Search Hook: {0063bf63-bfff-4b8f-9d26-4267df7f17dd} - c:\windows\system32\dvmurl.dll
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn2\yt.dll
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn2\yt.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: ZoneAlarm Security Engine Registrar: {8a4a36c2-0535-4d2c-bd3d-496cb7eed6e3} - c:\program files\checkpoint\zaforcefield\trustchecker\bin\TrustCheckerIEPlugin.dll
BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn2\YTSingleInstance.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn2\yt.dll
TB: ZoneAlarm Security Engine: {ee2ac4e5-b0b0-4ec6-88a9-bca1a32ab107} - c:\program files\checkpoint\zaforcefield\trustchecker\bin\TrustCheckerIEPlugin.dll
TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll
TB: {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - No File
uRun: [Google Update] "c:\documents and settings\owner\local settings\application data\google\update\GoogleUpdate.exe" /c
mRun: [SoundMan] SOUNDMAN.EXE
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe
mRun: [AlcWzrd] ALCWZRD.EXE
mRun: [Alcmtr] ALCMTR.EXE
mRun: [<NO NAME>]
mRun: [DeathAdder] c:\program files\razer\deathadder\razerhid.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit -login
mRun: [ISW]
mRun: [ZoneAlarm] c:\program files\checkpoint\zonealarm\zatray.exe
mRun: [WinPatrol] c:\program files\billp studios\winpatrol\winpatrol.exe -expressboot
mRun: [avast] "c:\program files\avast software\avast\avastUI.exe" /nogui
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1326078526484
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\program files\belarc\advisor\system\BAVoilaX.dll
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
Notify: e4056b56691 - c:\windows\system32\dot3msm32.dll
AppInit_DLLs: c:\windows\system32\dot3msm32.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
mASetup: {A509B1FF-37FF-4bFF-8CFF-4F3A747040FF} - c:\windows\system32\rundll32.exe c:\windows\system32\advpack.dll,launchinfsectionex c:\program files\internet explorer\clrtour.inf,DefaultInstall.ResetTour,,12
.
============= SERVICES / DRIVERS ===============
.
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2012-1-12 435032]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2012-1-12 314456]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2011-7-22 12880]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2011-7-12 67664]
R1 Vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2011-12-18 525840]
R2 !SASCORE;SAS Core Service;c:\program files\superantispyware\SASCore.exe [2011-8-11 116608]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2012-1-12 20568]
R2 avast! Antivirus;avast! Antivirus;c:\program files\avast software\avast\AvastSvc.exe [2012-1-12 44768]
R2 ISWKL;ZoneAlarm Toolbar ISWKL;c:\program files\checkpoint\zaforcefield\ISWKL.sys [2011-11-3 27016]
R2 IswSvc;ZoneAlarm Toolbar IswSvc;c:\program files\checkpoint\zaforcefield\ISWSVC.exe [2011-11-3 497280]
R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2009-5-7 652872]
R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\nvidia corporation\nvidia updatus\daemonu.exe [2011-7-8 2253120]
R3 DAdderFltr;DeathAdder Mouse;c:\windows\system32\drivers\dadder.sys [2009-5-6 22784]
R3 hidkmdf;Filter Driver Service for HID-KMDF Interface layer;c:\windows\system32\drivers\hidkmdf.sys [2011-7-8 6656]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2009-5-7 20464]
R3 VKbms;Virtual HID Minidriver;c:\windows\system32\drivers\VKbms.sys [2011-7-8 10240]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 GEST Service;GEST Service for program management.;c:\program files\gigabyte\energysaver\GSvr.exe [2009-4-30 68136]
S2 vsmon;TrueVector Internet Monitor;c:\program files\checkpoint\zonealarm\vsmon.exe -service --> c:\program files\checkpoint\zonealarm\vsmon.exe -service [?]
S3 CYUSB;Cypress Generic USB Driver;c:\windows\system32\drivers\CYUSB.sys [2009-5-6 38528]
S3 ip100xp;ENCORE 10/100Mbps Fast Ethernet PCI Adapter NT Driver;c:\windows\system32\drivers\ipfnd51.sys [2009-4-30 26752]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
.
=============== Created Last 30 ================
.
2012-01-15 01:51:14 -------- d-----w- c:\program files\UPHClean
2012-01-13 01:03:36 435032 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2012-01-13 01:03:22 41184 ----a-w- c:\windows\avastSS.scr
2012-01-13 01:03:11 -------- d-----w- c:\program files\AVAST Software
2012-01-13 01:03:11 -------- d-----w- c:\documents and settings\all users\application data\AVAST Software
2012-01-12 14:58:32 -------- d-----w- c:\documents and settings\owner\application data\WinPatrol
2012-01-12 14:58:21 -------- d-----w- c:\program files\BillP Studios
2012-01-12 14:58:21 -------- d-----w- c:\documents and settings\all users\application data\InstallMate
2012-01-09 22:25:07 274288 ----a-w- c:\windows\system32\mucltui.dll
2012-01-09 22:25:07 16736 ----a-w- c:\windows\system32\mucltui.dll.mui
2012-01-09 02:52:30 3840 ----a-w- c:\windows\system32\drivers\BANTExt.sys
2012-01-09 02:52:30 -------- d-----w- c:\program files\Belarc
2012-01-06 02:35:44 -------- d-----w- c:\documents and settings\owner\application data\SUPERAntiSpyware.com
2012-01-06 02:35:00 -------- d-----w- c:\program files\SUPERAntiSpyware
2012-01-06 02:35:00 -------- d-----w- c:\documents and settings\all users\application data\SUPERAntiSpyware.com
2012-01-05 19:47:40 388096 ----a-r- c:\documents and settings\owner\application data\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe
2012-01-05 19:47:40 -------- d-----w- c:\program files\Trend Micro
2012-01-03 22:05:24 -------- d-----w- c:\program files\Cisco Systems
2012-01-03 22:02:33 -------- d-----w- c:\documents and settings\all users\application data\Cisco Systems
2012-01-02 20:49:29 -------- d-sh--w- c:\documents and settings\owner\PrivacIE
2012-01-02 06:32:44 -------- d-----w- c:\documents and settings\owner\application data\CheckPoint
2012-01-02 06:32:23 -------- d-----w- c:\documents and settings\all users\application data\CheckPoint
2012-01-02 06:31:00 -------- d-----w- c:\program files\CheckPoint
2012-01-02 05:48:26 -------- d-----w- c:\documents and settings\owner\application data\AVG
2012-01-02 03:51:16 -------- d-----w- c:\documents and settings\owner\application data\AVG2012
2012-01-02 03:48:50 -------- d-----w- c:\program files\AVG
2012-01-02 02:45:44 -------- d--h--w- c:\documents and settings\all users\application data\Common Files
2012-01-02 02:34:41 -------- d-----w- c:\documents and settings\all users\application data\MFAData
2011-12-19 04:54:54 -------- d-----w- c:\documents and settings\owner\application data\Origin
2011-12-19 04:54:49 -------- d-----w- c:\documents and settings\owner\local settings\application data\Origin
2011-12-19 04:39:19 -------- d-----w- c:\program files\Origin Games
2011-12-19 04:38:56 -------- d-----w- c:\program files\Origin
2011-12-19 00:18:16 -------- d-----w- c:\windows\system32\wbem\repository\FS
2011-12-19 00:18:16 -------- d-----w- c:\windows\system32\wbem\Repository
.
==================== Find3M ====================
.
2012-01-17 04:24:54 16608 ----a-w- c:\windows\gdrv.sys
2011-12-19 18:58:56 33984 ----a-w- c:\windows\system32\cmdcsr.dll
2011-12-16 03:02:55 285192 ----a-w- c:\windows\system32\nvdrsdb0.bin
2011-12-16 03:02:55 1 ----a-w- c:\windows\system32\nvdrssel.bin
2011-12-16 03:02:52 285192 ----a-w- c:\windows\system32\nvdrsdb1.bin
2011-12-15 16:14:46 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-12-10 20:24:06 20464 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-11-25 21:57:19 293376 ----a-w- c:\windows\system32\winsrv.dll
2011-11-23 13:25:32 1859584 ----a-w- c:\windows\system32\win32k.sys
2011-11-18 12:35:08 60416 ----a-w- c:\windows\system32\packager.exe
2011-11-16 14:21:44 354816 ----a-w- c:\windows\system32\winhttp.dll
2011-11-16 14:21:44 152064 ----a-w- c:\windows\system32\schannel.dll
2011-11-10 10:54:13 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-11-10 08:27:10 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-11-04 19:20:51 916992 ----a-w- c:\windows\system32\wininet.dll
2011-11-04 19:20:51 43520 ------w- c:\windows\system32\licmgr10.dll
2011-11-04 19:20:51 1469440 ------w- c:\windows\system32\inetcpl.cpl
2011-11-04 11:23:59 385024 ------w- c:\windows\system32\html.iec
2011-11-03 15:28:36 386048 ----a-w- c:\windows\system32\qdvd.dll
2011-11-03 15:28:36 1292288 ----a-w- c:\windows\system32\quartz.dll
2011-11-01 16:07:10 1288704 ----a-w- c:\windows\system32\ole32.dll
2011-10-28 05:31:48 33280 ----a-w- c:\windows\system32\csrsrv.dll
2011-10-25 13:37:08 2148864 ----a-w- c:\windows\system32\ntoskrnl.exe
2011-10-25 12:52:02 2027008 ----a-w- c:\windows\system32\ntkrnlpa.exe
.
============= FINISH: 23:31:04.31 ===============

I tried 2 times scanning Gmer in normal mode. First time, it scanned (I hit scan and went to watch tv for a little bit) and at the end I saw this windows message and my computer was frozen and I had to manually force it to shut down. Rebooted and ran the second scan in normal mode and it scanned through with windows messages again but this time I was there to catch them and not have the pc freeze up. There were 5 of these messages I had to click ok though. They all read the same as this except each one the file name changes: Windows was unable to save all the data for the file /$Directory. The data has been lost. This error may be caused by a failure of your computer hardware or network connection. Please try to save this file elsewhere. It says this 4 more times as I mentioned and the file names are /windows/system32/config/sysevent.evt, C:/$mft, /$mft, /windows/system32/config/appevent.evt. While getting all these messages it scanned all the way through and I hit save, the program window closed and no window opened for me to save anywhere. Then I went and clicked task manager and it wouldn't open, so I went and tried to see if my google chrome would open and that wouldn't open either. Then my computer froze and I had to force to shut down. After that I decided to try it in safe mode and scan it. It scanned almost all the way to the end (over an hour as the others) and it restarted my computer back into safe mode by itself. On a side note, not sure if this matters or not, but when I ran those 2 scans in normal mode, main window opened up with information already in the window and then the scan just added to that information. As when I did the scan in safe mode, the main window opened empty and only filled with info as it scanned. I have tried searching to see if I could find any logs/scans for gmer with no luck only finding what was on my desktop except for whats in prefetch. Any ideas? I am going to go to bed as it's almost 4am and I need to wake up in a couple of hours. Hope to hear from you soon..I will check back tomorrow.

Hello, Welcome to BleepingComputer.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps.
===

Please download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

• Disable your Anti-Virus and Anti-Spyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
  
  
• Close any open browsers, and all other programs working. Make sure you save your file if working on a document.
  
  
• Do not install any other programs until this if fixed.[/b]
  
  
• Double click on ComboFix.exe & follow the prompts.
  
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
  
  
• Some Rookit infection may damage your boot sector. The Windows Recovery Console may be needed to restore it. Do not bypass this installation. You may regret it.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:



Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Note: If you have difficulty properly disabling your protection programs, refer to this link --> http://www.bleepingcomputer.com/forums/topic114351.html

Do not mouse click ComboFix's window while it's running. That may cause it to stall
===

Third party programs if not up to date can be the cause of infiltration an infection.

Please run this security check for my review.

Download Security Check by screen317 from here.

• Save it to your Desktop.
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.

===

Note: If after running ComboFix you get this error message "Illegal operation attempted on a registry key that has been marked for deletion." when attempting to run a program all you need to do is restart the computer to reset the registry.

Please post the logs and let me know if the problem persists.

Hello Nasdaq. Thanks for your help! I ran both programs and will show the logs after I am done writing this. I tested to see if things are better, but it's worse. I just tried 3 times to play my games and the crashing (black screen hanging application) comes after playing for only 1 minute now. I tried disabling my Avast and ZA and still the same. I even tried lowering my game settings for video to see if that helped with no luck still crashed after 1 minute. When the problem first came I was able to play at least 20-30 minutes before the crash (black screen but still have use of my keyboard and mouse to close the app in task manager).

I did all that combofix asked and it scanned and deleted some files and folders..Here is the combofix.txt and the checkup.txt that you asked for. I hope copying and pasting is ok as I didn't read anywhere that it had to be attached.

Combofix.txt


ComboFix 12-01-17.01 - Owner 01/17/2012 16:17:51.1.8 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3326.2851 [GMT -5:00]
Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: ZoneAlarm Free Firewall *Disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\TEMP
c:\documents and settings\Owner\Application Data\.#
c:\documents and settings\Owner\WINDOWS
C:\install.exe
C:\ipconfig.txt
c:\windows\system32\default_user_class.dat.LOG
c:\windows\system32\drivers\npf.sys
c:\windows\system32\LocalService
c:\windows\system32\Packet.dll
c:\windows\system32\pthreadVC.dll
c:\windows\system32\SET295.tmp
c:\windows\system32\SET29A.tmp
c:\windows\system32\wpcap.dll
.
.
((((((((((((((((((((((((( Files Created from 2011-12-17 to 2012-01-17 )))))))))))))))))))))))))))))))
.
.
2012-01-15 01:51 . 2012-01-15 02:11 -------- d-----w- c:\program files\UPHClean
2012-01-13 01:03 . 2011-11-28 17:53 314456 ----a-w- c:\windows\system32\drivers\aswSP.sys
2012-01-13 01:03 . 2011-11-28 17:51 20568 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2012-01-13 01:03 . 2011-11-28 17:52 34392 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2012-01-13 01:03 . 2011-11-28 17:52 52952 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2012-01-13 01:03 . 2011-11-28 17:53 435032 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2012-01-13 01:03 . 2011-11-28 17:52 111320 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2012-01-13 01:03 . 2011-11-28 17:51 105176 ----a-w- c:\windows\system32\drivers\aswmon.sys
2012-01-13 01:03 . 2011-11-28 17:48 30808 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2012-01-13 01:03 . 2011-11-28 18:01 41184 ----a-w- c:\windows\avastSS.scr
2012-01-13 01:03 . 2011-11-28 18:01 199816 ----a-w- c:\windows\system32\aswBoot.exe
2012-01-13 01:03 . 2012-01-13 01:03 -------- d-----w- c:\program files\AVAST Software
2012-01-13 01:03 . 2012-01-13 01:03 -------- d-----w- c:\documents and settings\All Users\Application Data\AVAST Software
2012-01-12 14:58 . 2012-01-12 14:58 -------- d-----w- c:\documents and settings\Owner\Application Data\WinPatrol
2012-01-12 14:58 . 2012-01-12 14:58 -------- d-----w- c:\program files\BillP Studios
2012-01-12 14:58 . 2012-01-12 14:58 -------- d-----w- c:\documents and settings\All Users\Application Data\InstallMate
2012-01-09 22:25 . 2009-08-07 00:23 274288 ----a-w- c:\windows\system32\mucltui.dll
2012-01-09 02:52 . 2012-01-09 02:52 -------- d-----w- c:\program files\Belarc
2012-01-09 02:52 . 2011-08-09 21:33 3840 ----a-w- c:\windows\system32\drivers\BANTExt.sys
2012-01-08 04:33 . 2012-01-08 04:34 -------- d-----w- c:\documents and settings\Administrator
2012-01-06 02:35 . 2012-01-06 02:35 -------- d-----w- c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com
2012-01-06 02:35 . 2012-01-16 02:38 -------- d-----w- c:\program files\SUPERAntiSpyware
2012-01-06 02:35 . 2012-01-06 02:35 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2012-01-05 19:47 . 2012-01-05 19:47 388096 ----a-r- c:\documents and settings\Owner\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2012-01-05 19:47 . 2012-01-05 19:47 -------- d-----w- c:\program files\Trend Micro
2012-01-03 22:05 . 2012-01-03 22:05 -------- d-----w- c:\program files\Cisco Systems
2012-01-03 22:02 . 2012-01-03 22:02 -------- d-----w- c:\documents and settings\All Users\Application Data\Cisco Systems
2012-01-02 20:49 . 2012-01-02 20:49 -------- d-sh--w- c:\documents and settings\Owner\PrivacIE
2012-01-02 06:32 . 2012-01-02 06:32 -------- d-----w- c:\documents and settings\Owner\Application Data\CheckPoint
2012-01-02 06:32 . 2012-01-02 06:32 -------- d-----w- c:\documents and settings\All Users\Application Data\CheckPoint
2012-01-02 06:31 . 2012-01-02 06:32 -------- d-----w- c:\program files\CheckPoint
2012-01-02 05:48 . 2012-01-02 05:48 -------- d-----w- c:\documents and settings\Owner\Application Data\AVG
2012-01-02 03:48 . 2012-01-05 03:32 -------- d-----w- c:\program files\AVG
2012-01-02 02:45 . 2012-01-02 02:45 -------- d--h--w- c:\documents and settings\All Users\Application Data\Common Files
2012-01-02 02:34 . 2012-01-13 00:57 -------- d-----w- c:\documents and settings\All Users\Application Data\MFAData
2011-12-19 04:54 . 2011-12-19 04:55 -------- d-----w- c:\documents and settings\Owner\Application Data\Origin
2011-12-19 04:54 . 2011-12-19 04:54 -------- d-----w- c:\documents and settings\Owner\Local Settings\Application Data\Origin
2011-12-19 04:39 . 2011-12-19 04:39 -------- d-----w- c:\program files\Origin Games
2011-12-19 04:38 . 2011-12-19 04:39 -------- d-----w- c:\program files\Origin
2011-12-19 00:18 . 2011-12-19 00:18 -------- d-----w- c:\windows\system32\wbem\Repository
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-01-17 17:42 . 2009-04-30 06:14 16608 ----a-w- c:\windows\gdrv.sys
2011-12-19 18:58 . 2011-11-17 02:13 33984 ----a-w- c:\windows\system32\cmdcsr.dll
2011-12-15 16:14 . 2011-05-27 14:44 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-12-10 20:24 . 2009-05-07 05:25 20464 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-11-25 21:57 . 2008-04-14 12:00 293376 ----a-w- c:\windows\system32\winsrv.dll
2011-11-23 13:25 . 2008-04-14 12:00 1859584 ----a-w- c:\windows\system32\win32k.sys
2011-11-18 12:35 . 2008-04-14 12:00 60416 ----a-w- c:\windows\system32\packager.exe
2011-11-16 14:21 . 2008-04-14 12:00 354816 ----a-w- c:\windows\system32\winhttp.dll
2011-11-16 14:21 . 2008-04-14 12:00 152064 ----a-w- c:\windows\system32\schannel.dll
2011-11-10 10:54 . 2010-07-27 04:31 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-11-10 08:27 . 2009-07-04 04:26 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-11-04 19:20 . 2008-04-14 12:00 916992 ----a-w- c:\windows\system32\wininet.dll
2011-11-04 19:20 . 2008-04-14 12:00 43520 ------w- c:\windows\system32\licmgr10.dll
2011-11-04 19:20 . 2008-04-14 12:00 1469440 ------w- c:\windows\system32\inetcpl.cpl
2011-11-04 11:23 . 2008-04-14 12:00 385024 ------w- c:\windows\system32\html.iec
2011-11-03 15:28 . 2008-04-14 12:00 386048 ----a-w- c:\windows\system32\qdvd.dll
2011-11-03 15:28 . 2008-04-14 12:00 1292288 ----a-w- c:\windows\system32\quartz.dll
2011-11-01 16:07 . 2008-04-14 12:00 1288704 ----a-w- c:\windows\system32\ole32.dll
2011-10-28 05:31 . 2008-04-14 12:00 33280 ----a-w- c:\windows\system32\csrsrv.dll
2011-10-25 13:37 . 2008-04-14 12:00 2148864 ----a-w- c:\windows\system32\ntoskrnl.exe
2011-10-25 12:52 . 2008-04-14 00:01 2027008 ----a-w- c:\windows\system32\ntkrnlpa.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-11-28 18:01 122512 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2008-06-18 77824]
"RTHDCPL"="RTHDCPL.EXE" [2008-07-23 16804864]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"AlcWzrd"="ALCWZRD.EXE" [2008-06-19 2808832]
"DeathAdder"="c:\program files\Razer\DeathAdder\razerhid.exe" [2011-03-21 248320]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2011-10-08 16744256]
"NvMediaCenter"="NvMCTray.dll" [2011-10-08 203072]
"ZoneAlarm"="c:\program files\CheckPoint\ZoneAlarm\zatray.exe" [2011-12-19 73360]
"WinPatrol"="c:\program files\BillP Studios\WinPatrol\winpatrol.exe" [2012-01-02 325728]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-11-28 3744552]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-07-19 113024]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2011-05-04 17:54 551296 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Exif Launcher S.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Exif Launcher S.lnk
backup=c:\windows\pss\Exif Launcher S.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
backup=c:\windows\pss\Kodak EasyShare software.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^KODAK Software Updater.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\KODAK Software Updater.lnk
backup=c:\windows\pss\KODAK Software Updater.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Trojan Guarder.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Trojan Guarder.lnk
backup=c:\windows\pss\Trojan Guarder.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2011-06-06 16:55 937920 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-09-05 17:04 35736 ----a-w- c:\program files\Adobe\Reader 10.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 12:00 15360 ----a-w- c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes Anti-Malware (reboot)]
2011-12-24 22:50 981680 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbam.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]
2011-12-24 22:50 460872 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2011-10-08 04:50 1632360 ----a-w- c:\program files\NVIDIA Corporation\nView\nwiz.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 22:38 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2011-06-09 17:06 254696 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
2011-12-09 00:44 4616064 ----a-w- c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Steam\\steam.exe"=
"c:\\Program Files\\Steam\\SteamApps\\latinsweetheart26\\team fortress 2\\hl2.exe"=
"c:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\backWeb-7288971.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Steam\\SteamApps\\common\\monday night combat\\Binaries\\Win32\\mnc.exe"=
"c:\\Program Files\\Steam\\SteamApps\\common\\left 4 dead\\left4dead.exe"=
"c:\\Program Files\\NVIDIA Corporation\\NVIDIA Updatus\\daemonu.exe"=
"c:\\Program Files\\Steam\\SteamApps\\common\\left 4 dead 2\\left4dead2.exe"=
.
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [1/12/2012 8:03 PM 435032]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [1/12/2012 8:03 PM 314456]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [7/22/2011 11:27 AM 12880]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [7/12/2011 4:55 PM 67664]
R2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCore.exe [8/11/2011 6:38 PM 116608]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [1/12/2012 8:03 PM 20568]
R2 ISWKL;ZoneAlarm Toolbar ISWKL;c:\program files\CheckPoint\ZAForceField\ISWKL.sys [11/3/2011 9:44 AM 27016]
R2 IswSvc;ZoneAlarm Toolbar IswSvc;c:\program files\CheckPoint\ZAForceField\ISWSVC.exe [11/3/2011 9:44 AM 497280]
R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [7/8/2011 2:12 PM 2253120]
R3 DAdderFltr;DeathAdder Mouse;c:\windows\system32\drivers\dadder.sys [5/6/2009 9:45 PM 22784]
R3 hidkmdf;Filter Driver Service for HID-KMDF Interface layer;c:\windows\system32\drivers\hidkmdf.sys [7/8/2011 2:32 PM 6656]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [5/7/2009 12:25 AM 20464]
R3 VKbms;Virtual HID Minidriver;c:\windows\system32\drivers\VKbms.sys [7/8/2011 2:32 PM 10240]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3/18/2010 1:16 PM 130384]
S2 GEST Service;GEST Service for program management.;c:\program files\GIGABYTE\EnergySaver\GSvr.exe [4/30/2009 1:15 AM 68136]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [5/7/2009 12:25 AM 652872]
S3 CYUSB;Cypress Generic USB Driver;c:\windows\system32\drivers\CYUSB.sys [5/6/2009 9:45 PM 38528]
S3 ip100xp;ENCORE 10/100Mbps Fast Ethernet PCI Adapter NT Driver;c:\windows\system32\drivers\ipfnd51.sys [4/30/2009 1:29 AM 26752]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [3/18/2010 1:16 PM 753504]
.
--- Other Services/Drivers In Memory ---
.
*Deregistered* - uphcleanhlp
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
2009-03-08 09:32 128512 ----a-w- c:\windows\system32\advpack.dll
.
Contents of the 'Scheduled Tasks' folder
.
2012-01-05 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-527237240-1677128483-1417001333-1003Core.job
- c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-07-28 20:48]
.
2012-01-17 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-527237240-1677128483-1417001333-1003UA.job
- c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-07-28 20:48]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/?fr=fp-yie8
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = localhost
TCP: DhcpNameServer = 167.206.245.129 167.206.245.130
.
- - - - ORPHANS REMOVED - - - -
.
HKLM-Run-ISW - (no file)
Notify-e4056b56691 - c:\windows\System32\dot3msm32.dll
MSConfigStartUp-Messenger (Yahoo!) - c:\program files\Yahoo!\Messenger\YahooMessenger.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-01-17 16:24
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(836)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86\MSVCR80.dll
.
- - - - - - - > 'lsass.exe'(892)
c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
.
Completion time: 2012-01-17 16:26:52
ComboFix-quarantined-files.txt 2012-01-17 21:26
.
Pre-Run: 641,496,461,312 bytes free
Post-Run: 641,576,308,736 bytes free
.
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect/3GB /NoExecute=OptIn
.
- - End Of File - - ACBA90E7534C3928C69BB51205C5BB93

Checkup.txt


Results of screen317's Security Check version 0.99.30
Windows XP Service Pack 3 x86
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
avast! Free Antivirus
ZoneAlarm Firewall
ZoneAlarm Free
ZoneAlarm Toolbar
ZoneAlarm Security
```````````````````````````````
Anti-malware/Other Utilities Check:
SUPERAntiSpyware
CCleaner
Java™ 6 Update 30
Adobe Flash Player 11.1.102.55
Adobe Reader X (10.1.1)
````````````````````````````````
Process Check:
objlist.exe by Laurent
WinPatrol winpatrol.exe is disabled!
AVAST Software Avast AvastSvc.exe
AVAST Software Avast avastUI.exe
``````````End of Log````````````

Please Download
TDSSKiller.zip

>>> Double-click on TDSSKiller.exe to run the application.

• Click on the Start Scan button and wait for the scan and disinfection process to be over.
  
• If an infected file is detected, the default action will be Cure, click on Continue
  
  
• If a suspicious file is detected, the default action will be Skip, click on Continue
  
  
• If you are asked to reboot the computer to complete the process, click on the Reboot Now button. A report will be automatically saved at the root of the System drive ((usually C:\) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt" (for example, C:\TDSSKiller.2.2.0_20.12.2009_15.31.43_log.txt). Please copy and paste the contents of that file here.
  
• If no reboot is required, click on Report. A log file will appear. Please copy and paste the contents of that file in your next reply.

Download http://public.avast.com/~gmerek/aswMBR.exe (aswMBR.exe) ( 511KB ) to your desktop. Double click the aswMBR.exe to run it

• Click the "Scan" button to start scan.
  
• Upon completion of the scan, click Save log, and save it to your desktop. (Note - do not select any Fix at this time) <- IMPORTANT
  
• Please post the contents of that log in your next reply.

There shall also be a file on your desktop named MBR.dat. Right click that file and select Send To>Compressed (zipped) folder. Please attach that zipped file in your next reply.

===

Please post the logs for my review.

TDSSKiller didn't find anything. Here's the report.


17:48:46.0140 0272 TDSS rootkit removing tool 2.7.5.0 Jan 18 2012 09:26:24
17:48:46.0375 0272 ============================================================
17:48:46.0375 0272 Current date / time: 2012/01/18 17:48:46.0375
17:48:46.0375 0272 SystemInfo:
17:48:46.0375 0272
17:48:46.0375 0272 OS Version: 5.1.2600 ServicePack: 3.0
17:48:46.0375 0272 Product type: Workstation
17:48:46.0375 0272 ComputerName: USER-D3FCA06E5B
17:48:46.0375 0272 UserName: Owner
17:48:46.0375 0272 Windows directory: C:\WINDOWS
17:48:46.0375 0272 System windows directory: C:\WINDOWS
17:48:46.0375 0272 Processor architecture: Intel x86
17:48:46.0375 0272 Number of processors: 8
17:48:46.0375 0272 Page size: 0x1000
17:48:46.0375 0272 Boot type: Normal boot
17:48:46.0375 0272 ============================================================
17:48:47.0718 0272 Drive \Device\Harddisk0\DR0 - Size: 0xAEA8BD5E00 (698.64 Gb), SectorSize: 0x200, Cylinders: 0x16441, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
17:48:47.0781 0272 Initialize success
17:49:11.0250 3016 ============================================================
17:49:11.0250 3016 Scan started
17:49:11.0250 3016 Mode: Manual;
17:49:11.0250 3016 ============================================================
17:49:11.0437 3016 Aavmker4 (b6de0336f9f4b687b4ff57939f7b657a) C:\WINDOWS\system32\drivers\Aavmker4.sys
17:49:11.0437 3016 Aavmker4 - ok
17:49:11.0453 3016 Abiosdsk - ok
17:49:11.0453 3016 abp480n5 - ok
17:49:11.0500 3016 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
17:49:11.0500 3016 ACPI - ok
17:49:11.0531 3016 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
17:49:11.0531 3016 ACPIEC - ok
17:49:11.0531 3016 adpu160m - ok
17:49:11.0562 3016 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
17:49:11.0562 3016 aec - ok
17:49:11.0593 3016 AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
17:49:11.0593 3016 AFD - ok
17:49:11.0593 3016 Aha154x - ok
17:49:11.0609 3016 aic78u2 - ok
17:49:11.0609 3016 aic78xx - ok
17:49:11.0609 3016 AliIde - ok
17:49:11.0625 3016 amsint - ok
17:49:11.0671 3016 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
17:49:11.0671 3016 Arp1394 - ok
17:49:11.0671 3016 asc - ok
17:49:11.0671 3016 asc3350p - ok
17:49:11.0671 3016 asc3550 - ok
17:49:11.0687 3016 aswFsBlk (054df24c92b55427e0757cfff160e4f2) C:\WINDOWS\system32\drivers\aswFsBlk.sys
17:49:11.0687 3016 aswFsBlk - ok
17:49:11.0687 3016 aswMon2 (ef0e9ad83380724bd6fbbb51d2d0f5b8) C:\WINDOWS\system32\drivers\aswMon2.sys
17:49:11.0687 3016 aswMon2 - ok
17:49:11.0703 3016 aswRdr (352d5a48ebab35a7693b048679304831) C:\WINDOWS\system32\drivers\aswRdr.sys
17:49:11.0703 3016 aswRdr - ok
17:49:11.0703 3016 aswSnx (8d34d2b24297e27d93e847319abfdec4) C:\WINDOWS\system32\drivers\aswSnx.sys
17:49:11.0703 3016 aswSnx - ok
17:49:11.0718 3016 aswSP (010012597333da1f46c3243f33f8409e) C:\WINDOWS\system32\drivers\aswSP.sys
17:49:11.0718 3016 aswSP - ok
17:49:11.0718 3016 aswTdi (f9f84364416658e9786235904d448d37) C:\WINDOWS\system32\drivers\aswTdi.sys
17:49:11.0734 3016 aswTdi - ok
17:49:11.0750 3016 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
17:49:11.0750 3016 AsyncMac - ok
17:49:11.0781 3016 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
17:49:11.0781 3016 atapi - ok
17:49:11.0796 3016 Atdisk - ok
17:49:11.0812 3016 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
17:49:11.0812 3016 Atmarpc - ok
17:49:11.0859 3016 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
17:49:11.0859 3016 audstub - ok
17:49:11.0875 3016 BANTExt (5d7be7b19e827125e016325334e58ff1) C:\WINDOWS\System32\Drivers\BANTExt.sys
17:49:11.0875 3016 BANTExt - ok
17:49:11.0921 3016 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
17:49:11.0921 3016 Beep - ok
17:49:12.0000 3016 catchme - ok
17:49:12.0031 3016 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
17:49:12.0031 3016 cbidf2k - ok
17:49:12.0046 3016 cd20xrnt - ok
17:49:12.0078 3016 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
17:49:12.0078 3016 Cdaudio - ok
17:49:12.0093 3016 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
17:49:12.0093 3016 Cdfs - ok
17:49:12.0125 3016 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
17:49:12.0125 3016 Cdrom - ok
17:49:12.0125 3016 Changer - ok
17:49:12.0140 3016 CmdIde - ok
17:49:12.0140 3016 Cpqarray - ok
17:49:12.0171 3016 CYUSB (56da869b46a09f57166fc86bf46d0084) C:\WINDOWS\system32\Drivers\CYUSB.sys
17:49:12.0171 3016 CYUSB - ok
17:49:12.0171 3016 dac2w2k - ok
17:49:12.0187 3016 dac960nt - ok
17:49:12.0218 3016 DAdderFltr (cb90f77e21109ccfd114a17bd87a42a7) C:\WINDOWS\system32\drivers\dadder.sys
17:49:12.0218 3016 DAdderFltr - ok
17:49:12.0234 3016 DcCam (30e4c5de753616ba1243a05a4ff5aad2) C:\WINDOWS\system32\DRIVERS\DcCam.sys
17:49:12.0234 3016 DcCam - ok
17:49:12.0250 3016 DcFpoint (a444074caaccc2e794d2e5f93d2679ee) C:\WINDOWS\system32\DRIVERS\DcFpoint.sys
17:49:12.0250 3016 DcFpoint - ok
17:49:12.0265 3016 DCFS2K (6e770432a09617ca74cb0525edf06ef3) C:\WINDOWS\system32\drivers\dcfs2k.sys
17:49:12.0265 3016 DCFS2K - ok
17:49:12.0296 3016 DcLps (89977377aa94d71c1dde3a82d23223cc) C:\WINDOWS\system32\DRIVERS\DcLps.sys
17:49:12.0296 3016 DcLps - ok
17:49:12.0312 3016 DcPTP (ce0ae71bb5a092d5bb0b298d5bc7a208) C:\WINDOWS\system32\DRIVERS\DcPTP.sys
17:49:12.0312 3016 DcPTP - ok
17:49:12.0328 3016 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
17:49:12.0328 3016 Disk - ok
17:49:12.0375 3016 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
17:49:12.0390 3016 dmboot - ok
17:49:12.0406 3016 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys
17:49:12.0406 3016 dmio - ok
17:49:12.0421 3016 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
17:49:12.0437 3016 dmload - ok
17:49:12.0468 3016 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
17:49:12.0468 3016 DMusic - ok
17:49:12.0468 3016 dpti2o - ok
17:49:12.0468 3016 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
17:49:12.0468 3016 drmkaud - ok
17:49:12.0515 3016 ENTECH (fd9fc82f134b1c91004ffc76a5ae494b) C:\WINDOWS\system32\DRIVERS\ENTECH.sys
17:49:12.0515 3016 ENTECH - ok
17:49:12.0531 3016 Exportit (80fb249def6f5a157b531349e71cc6ac) C:\WINDOWS\system32\DRIVERS\exportit.sys
17:49:12.0531 3016 Exportit - ok
17:49:12.0546 3016 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
17:49:12.0546 3016 Fastfat - ok
17:49:12.0562 3016 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
17:49:12.0578 3016 Fdc - ok
17:49:12.0578 3016 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
17:49:12.0593 3016 Fips - ok
17:49:12.0593 3016 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
17:49:12.0593 3016 Flpydisk - ok
17:49:12.0625 3016 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
17:49:12.0640 3016 FltMgr - ok
17:49:12.0640 3016 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
17:49:12.0640 3016 Fs_Rec - ok
17:49:12.0640 3016 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
17:49:12.0640 3016 Ftdisk - ok
17:49:12.0703 3016 gdrv (c6e3105b8c68c35cc1eb26a00fd1a8c6) C:\WINDOWS\gdrv.sys
17:49:13.0765 3016 gdrv - ok
17:49:13.0890 3016 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
17:49:13.0890 3016 Gpc - ok
17:49:13.0937 3016 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
17:49:13.0937 3016 HDAudBus - ok
17:49:13.0968 3016 hidkmdf (bb1822838c0714b3c03efe0f209d135d) C:\WINDOWS\system32\DRIVERS\hidkmdf.sys
17:49:13.0968 3016 hidkmdf - ok
17:49:14.0015 3016 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
17:49:14.0015 3016 HidUsb - ok
17:49:14.0015 3016 hpn - ok
17:49:14.0062 3016 HPZid412 (d03d10f7ded688fecf50f8fbf1ea9b8a) C:\WINDOWS\system32\DRIVERS\HPZid412.sys
17:49:14.0062 3016 HPZid412 - ok
17:49:14.0093 3016 HPZipr12 (89f41658929393487b6b7d13c8528ce3) C:\WINDOWS\system32\DRIVERS\HPZipr12.sys
17:49:14.0093 3016 HPZipr12 - ok
17:49:14.0125 3016 HPZius12 (abcb05ccdbf03000354b9553820e39f8) C:\WINDOWS\system32\DRIVERS\HPZius12.sys
17:49:14.0125 3016 HPZius12 - ok
17:49:14.0140 3016 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
17:49:14.0140 3016 HTTP - ok
17:49:14.0156 3016 i2omgmt - ok
17:49:14.0156 3016 i2omp - ok
17:49:14.0187 3016 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
17:49:14.0187 3016 i8042prt - ok
17:49:14.0187 3016 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
17:49:14.0187 3016 Imapi - ok
17:49:14.0203 3016 ini910u - ok
17:49:14.0328 3016 IntcAzAudAddService (4aaa8312732655f93a254d1fa695eb79) C:\WINDOWS\system32\drivers\RtkHDAud.sys
17:49:14.0343 3016 IntcAzAudAddService - ok
17:49:14.0359 3016 IntelIde - ok
17:49:14.0375 3016 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys
17:49:14.0375 3016 intelppm - ok
17:49:14.0406 3016 ip100xp (647d40b7a2a3847a76a0de51c4ae43f6) C:\WINDOWS\system32\DRIVERS\ipfnd51.sys
17:49:14.0406 3016 ip100xp - ok
17:49:14.0406 3016 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
17:49:14.0406 3016 Ip6Fw - ok
17:49:14.0437 3016 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
17:49:14.0437 3016 IpFilterDriver - ok
17:49:14.0453 3016 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
17:49:14.0453 3016 IpInIp - ok
17:49:14.0484 3016 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
17:49:14.0484 3016 IpNat - ok
17:49:14.0484 3016 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
17:49:14.0484 3016 IPSec - ok
17:49:14.0531 3016 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
17:49:14.0531 3016 IRENUM - ok
17:49:14.0562 3016 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
17:49:14.0562 3016 isapnp - ok
17:49:14.0609 3016 ISWKL (08a811bfd207dfdec588881c18bacbaa) C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys
17:49:14.0609 3016 ISWKL - ok
17:49:14.0609 3016 JRAID (a324485106f133e751f4b7f47c4be3ea) C:\WINDOWS\system32\DRIVERS\jraid.sys
17:49:14.0609 3016 JRAID - ok
17:49:14.0625 3016 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
17:49:14.0625 3016 Kbdclass - ok
17:49:14.0671 3016 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
17:49:14.0671 3016 kbdhid - ok
17:49:14.0687 3016 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
17:49:14.0687 3016 kmixer - ok
17:49:14.0734 3016 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
17:49:14.0734 3016 KSecDD - ok
17:49:14.0734 3016 lbrtfdc - ok
17:49:14.0765 3016 MBAMProtector (b7ca8cc3f978201856b6ab82f40953c3) C:\WINDOWS\system32\drivers\mbam.sys
17:49:14.0765 3016 MBAMProtector - ok
17:49:14.0781 3016 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
17:49:14.0781 3016 mnmdd - ok
17:49:14.0796 3016 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
17:49:14.0796 3016 Modem - ok
17:49:14.0828 3016 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
17:49:14.0828 3016 Mouclass - ok
17:49:14.0828 3016 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
17:49:14.0828 3016 mouhid - ok
17:49:14.0828 3016 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
17:49:14.0828 3016 MountMgr - ok
17:49:14.0843 3016 mraid35x - ok
17:49:14.0843 3016 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
17:49:14.0843 3016 MRxDAV - ok
17:49:14.0890 3016 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
17:49:14.0906 3016 MRxSmb - ok
17:49:14.0906 3016 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
17:49:14.0906 3016 Msfs - ok
17:49:14.0937 3016 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
17:49:14.0937 3016 MSKSSRV - ok
17:49:14.0937 3016 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
17:49:14.0937 3016 MSPCLOCK - ok
17:49:14.0937 3016 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
17:49:14.0937 3016 MSPQM - ok
17:49:14.0953 3016 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
17:49:14.0968 3016 mssmbios - ok
17:49:14.0984 3016 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
17:49:14.0984 3016 Mup - ok
17:49:15.0000 3016 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
17:49:15.0000 3016 NDIS - ok
17:49:15.0015 3016 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
17:49:15.0015 3016 NdisTapi - ok
17:49:15.0046 3016 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
17:49:15.0046 3016 Ndisuio - ok
17:49:15.0062 3016 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
17:49:15.0062 3016 NdisWan - ok
17:49:15.0078 3016 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
17:49:15.0078 3016 NDProxy - ok
17:49:15.0078 3016 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
17:49:15.0078 3016 NetBIOS - ok
17:49:15.0125 3016 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
17:49:15.0140 3016 NetBT - ok
17:49:15.0156 3016 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
17:49:15.0156 3016 NIC1394 - ok
17:49:15.0156 3016 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
17:49:15.0156 3016 Npfs - ok
17:49:15.0171 3016 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
17:49:15.0187 3016 Ntfs - ok
17:49:15.0218 3016 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
17:49:15.0218 3016 Null - ok
17:49:15.0484 3016 nv (4b54dcd6adee535df80f07c59ddd8f14) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
17:49:15.0750 3016 nv - ok
17:49:15.0781 3016 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
17:49:15.0781 3016 NwlnkFlt - ok
17:49:15.0796 3016 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
17:49:15.0796 3016 NwlnkFwd - ok
17:49:15.0812 3016 ohci1394 (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
17:49:15.0812 3016 ohci1394 - ok
17:49:15.0843 3016 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\drivers\Parport.sys
17:49:15.0843 3016 Parport - ok
17:49:15.0843 3016 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
17:49:15.0843 3016 PartMgr - ok
17:49:15.0875 3016 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
17:49:15.0875 3016 ParVdm - ok
17:49:15.0890 3016 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys
17:49:15.0890 3016 PCI - ok
17:49:15.0890 3016 PCIDump - ok
17:49:15.0906 3016 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
17:49:15.0906 3016 PCIIde - ok
17:49:15.0921 3016 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys
17:49:15.0921 3016 Pcmcia - ok
17:49:15.0921 3016 PDCOMP - ok
17:49:15.0937 3016 PDFRAME - ok
17:49:15.0937 3016 PDRELI - ok
17:49:15.0937 3016 PDRFRAME - ok
17:49:15.0937 3016 perc2 - ok
17:49:15.0953 3016 perc2hib - ok
17:49:15.0984 3016 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
17:49:15.0984 3016 PptpMiniport - ok
17:49:16.0000 3016 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
17:49:16.0000 3016 PSched - ok
17:49:16.0015 3016 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
17:49:16.0031 3016 Ptilink - ok
17:49:16.0031 3016 ql1080 - ok
17:49:16.0031 3016 Ql10wnt - ok
17:49:16.0031 3016 ql12160 - ok
17:49:16.0046 3016 ql1240 - ok
17:49:16.0046 3016 ql1280 - ok
17:49:16.0046 3016 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
17:49:16.0046 3016 RasAcd - ok
17:49:16.0078 3016 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
17:49:16.0078 3016 Rasl2tp - ok
17:49:16.0078 3016 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
17:49:16.0078 3016 RasPppoe - ok
17:49:16.0093 3016 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
17:49:16.0093 3016 Raspti - ok
17:49:16.0093 3016 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
17:49:16.0093 3016 Rdbss - ok
17:49:16.0093 3016 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
17:49:16.0093 3016 RDPCDD - ok
17:49:16.0125 3016 RDPWD (fc105dd312ed64eb66bff111e8ec6eac) C:\WINDOWS\system32\drivers\RDPWD.sys
17:49:16.0125 3016 RDPWD - ok
17:49:16.0156 3016 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
17:49:16.0156 3016 redbook - ok
17:49:16.0187 3016 RTLE8023xp (0c57c0f776361b155b00d245c99b41f6) C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys
17:49:16.0187 3016 RTLE8023xp - ok
17:49:16.0265 3016 SASDIFSV (39763504067962108505bff25f024345) C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
17:49:16.0265 3016 SASDIFSV - ok
17:49:16.0281 3016 SASKUTIL (77b9fc20084b48408ad3e87570eb4a85) C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS
17:49:16.0281 3016 SASKUTIL - ok
17:49:16.0296 3016 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
17:49:16.0296 3016 Secdrv - ok
17:49:16.0296 3016 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
17:49:16.0312 3016 serenum - ok
17:49:16.0312 3016 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys
17:49:16.0312 3016 Serial - ok
17:49:16.0328 3016 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
17:49:16.0328 3016 Sfloppy - ok
17:49:16.0328 3016 Simbad - ok
17:49:16.0328 3016 Sparrow - ok
17:49:16.0359 3016 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
17:49:16.0359 3016 splitter - ok
17:49:16.0406 3016 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
17:49:16.0406 3016 sr - ok
17:49:16.0437 3016 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
17:49:16.0437 3016 Srv - ok
17:49:16.0453 3016 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
17:49:16.0453 3016 swenum - ok
17:49:16.0468 3016 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
17:49:16.0468 3016 swmidi - ok
17:49:16.0468 3016 symc810 - ok
17:49:16.0468 3016 symc8xx - ok
17:49:16.0484 3016 sym_hi - ok
17:49:16.0484 3016 sym_u3 - ok
17:49:16.0515 3016 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
17:49:16.0515 3016 sysaudio - ok
17:49:16.0578 3016 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
17:49:16.0578 3016 Tcpip - ok
17:49:16.0593 3016 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
17:49:16.0593 3016 TDPIPE - ok
17:49:16.0609 3016 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
17:49:16.0609 3016 TDTCP - ok
17:49:16.0625 3016 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
17:49:16.0625 3016 TermDD - ok
17:49:16.0625 3016 TosIde - ok
17:49:16.0640 3016 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
17:49:16.0640 3016 Udfs - ok
17:49:16.0640 3016 ultra - ok
17:49:16.0671 3016 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
17:49:16.0671 3016 Update - ok
17:49:16.0703 3016 usbaudio (e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys
17:49:16.0703 3016 usbaudio - ok
17:49:16.0718 3016 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
17:49:16.0718 3016 usbccgp - ok
17:49:16.0718 3016 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
17:49:16.0718 3016 usbehci - ok
17:49:16.0734 3016 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
17:49:16.0734 3016 usbhub - ok
17:49:16.0750 3016 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
17:49:16.0750 3016 usbprint - ok
17:49:16.0812 3016 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
17:49:16.0812 3016 usbscan - ok
17:49:16.0843 3016 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
17:49:16.0843 3016 USBSTOR - ok
17:49:16.0859 3016 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
17:49:16.0859 3016 usbuhci - ok
17:49:16.0859 3016 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
17:49:16.0859 3016 VgaSave - ok
17:49:16.0859 3016 ViaIde - ok
17:49:16.0890 3016 VKbms (07c20e596a0838809bc5ff5de5a65973) C:\WINDOWS\system32\DRIVERS\VKbms.sys
17:49:16.0890 3016 VKbms - ok
17:49:16.0906 3016 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
17:49:16.0906 3016 VolSnap - ok
17:49:16.0937 3016 Vsdatant (b0d3c4497d1ed91628dc56f592aebef4) C:\WINDOWS\system32\vsdatant.sys
17:49:17.0031 3016 Vsdatant - ok
17:49:17.0062 3016 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
17:49:17.0062 3016 Wanarp - ok
17:49:17.0093 3016 Wdf01000 (d918617b46457b9ac28027722e30f647) C:\WINDOWS\system32\Drivers\wdf01000.sys
17:49:17.0109 3016 Wdf01000 - ok
17:49:17.0109 3016 WDICA - ok
17:49:17.0125 3016 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
17:49:17.0125 3016 wdmaud - ok
17:49:17.0156 3016 WmiAcpi (c42584fd66ce9e17403aebca199f7bdb) C:\WINDOWS\system32\DRIVERS\wmiacpi.sys
17:49:17.0156 3016 WmiAcpi - ok
17:49:17.0203 3016 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys
17:49:17.0203 3016 WS2IFSL - ok
17:49:17.0234 3016 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
17:49:17.0234 3016 WudfPf - ok
17:49:17.0250 3016 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
17:49:17.0250 3016 WudfRd - ok
17:49:17.0265 3016 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0
17:49:17.0390 3016 \Device\Harddisk0\DR0 - ok
17:49:17.0390 3016 Boot (0x1200) (7fd34a2af56ffaa446b255b748d2f15e) \Device\Harddisk0\DR0\Partition0
17:49:17.0390 3016 \Device\Harddisk0\DR0\Partition0 - ok
17:49:17.0390 3016 ============================================================
17:49:17.0390 3016 Scan finished
17:49:17.0390 3016 ============================================================
17:49:17.0390 2988 Detected object count: 0
17:49:17.0390 2988 Actual detected object count: 0


Going to go do the aswMBR right now.

aswMBR version 0.9.9.1297 Copyright© 2011 AVAST Software
Run date: 2012-01-18 17:54:12
-----------------------------
17:54:12.968 OS Version: Windows 5.1.2600 Service Pack 3
17:54:12.968 Number of processors: 8 586 0x1A04
17:54:12.968 ComputerName: USER-D3FCA06E5B UserName: Owner
17:54:14.156 Initialize success
17:54:14.171 AVAST engine defs: 12011801
17:54:25.828 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T1L0-9
17:54:25.828 Disk 0 Vendor: WDC_WD7500AACS-00D6B1 01.01A01 Size: 715403MB BusType: 3
17:54:25.843 Disk 0 MBR read successfully
17:54:25.843 Disk 0 MBR scan
17:54:25.843 Disk 0 Windows XP default MBR code
17:54:25.843 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 715394 MB offset 63
17:54:25.843 Disk 0 scanning sectors +1465128000
17:54:25.921 Disk 0 scanning C:\WINDOWS\system32\drivers
17:54:29.796 Service scanning
17:54:30.718 Modules scanning
17:54:33.750 Disk 0 trace - called modules:
17:54:33.765 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS
17:54:33.765 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfcc7cab8]
17:54:34.265 3 CLASSPNP.SYS[f5e28fd7] -> nt!IofCallDriver -> \Device\00000076[0xfcc619e8]
17:54:34.265 5 ACPI.sys[f5c9f620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP1T1L0-9[0xfcc81940]
17:54:35.375 AVAST engine scan C:\WINDOWS
17:54:41.125 AVAST engine scan C:\WINDOWS\system32
17:55:34.953 AVAST engine scan C:\WINDOWS\system32\drivers
17:55:44.859 AVAST engine scan C:\Documents and Settings\Owner
18:03:45.687 AVAST engine scan C:\Documents and Settings\All Users
18:04:42.250 Scan finished successfully
18:12:18.453 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Owner\Desktop\MBR.dat"
18:12:18.453 The log file has been saved successfully to "C:\Documents and Settings\Owner\Desktop\aswMBR.txt"

If you have a good restore point I would use it to restore my computer to a date prior to the beginning of this problem.

Please confirm.

I am not sure which would be a good restore point as I am not really sure when this started happening. I hadn't played my steam games for maybe 2 months. Then came back to play some L4d2 and played for 20-30 minutes and then it would crash & I look in the computer logs and I see that the application would hang. It also happens with my sims 3 (you don't need internet for this game) game. If I try a restore point, will the programs and such be gone that I had downloaded/installed after that date? How do I know which restore points are good? Can you tell me what was on my pc that was bad that you took off? Am I all free of bad stuff on my pc now?

I forgot to mention this before. My free Zone Alarm firewall, when you open the main page it shows computer, internet, & Identity and Data. Well, my internet part, by itself, turns to off multiple times everyday. Also, I have always had automatic updates for Windows, but for awhile now it hasn't done them. I would have to go do it manually through the website because the updates wouldn't go by themselves. Was wondering if any of this info means anything bad on the pc?

You cannot run two Firewall programs simultaneously.

Antivirus/Firewall Check:
Windows Firewall Enabled!
ZoneAlarm Firewall

Decide which one you want running and disable the other.
===
Also, I have always had automatic updates for Windows, but for awhile now it hasn't done them. I would have to go do it manually through the website because the updates wouldn't go by themselves

Try this fix.
http://www.thewindowsclub.com/repair-fix-windows-updates-with-fix-wu-utility
===

Does the computer hangs only when you are playing games?

===

Let see what this scan will find.

I'd like us to scan your machine with ESET OnlineScan

• Hold down Control and click on the following link to open ESET OnlineScan in a new window.
  ESET OnlineScan
  
• Click the button.
  
• For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
  • Click on to download the ESET Smart Installer. Save it to your desktop.
    
  • Double click on the icon on your desktop.
  
  
• Check
  
• Click the button.
  
• Accept any security warnings from your browser.
  
• Check
  
• Push the Start button.
  
• ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  
• When the scan completes, push
  
• Push , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  
• Push the button.
  
• Push