I also tried a scan with XDelBox, which found that there was an issue with iastor.sys but was unable to quarantine or fix it. I tried to start in Safe Mode, but get the blue screen of death. I tried to create a Recovery Console, but it has an error, saying winnt32 doesn't work and quits me out of it. I also tried the TDSSKiller, TDSS rootkit removing tool from Kaspersky Lab and nothing worked. Per some other instructions I found online, I also cleaned up my hosts file, which was full of random websites.
I know there are a few other things I have tried, but I can't for the life of me remember them. What I do know is that I have gotten absolutely nowhere in the past 3-4 days.
I have never run into anything like this and am not sure what else to do. I will attach the files here that I read about in the guidelines. Please let me know what else you might need and thanks in advance for looking into this.
DDS (Ver_09-12-01.01) - NTFSx86
Run by lovenut at 2:02:05.54 on Thu 01/21/2010
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_11
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1364 [GMT -8:00]
AV: Kaspersky Internet Security *On-access scanning enabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *enabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
============== Running Processes ===============
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\lxddcoms.exe
C:\WINDOWS\system32\nvsvc32.exe
svchost.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe
C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WMP54Gv4.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Lexmark 2500 Series\lxddmon.exe
C:\Program Files\Lexmark 2500 Series\lxddamon.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\WINDOWS\system32\CTXFIHLP.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
C:\WINDOWS\SYSTEM32\CTXFISPI.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\ehome\RMSysTry.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtblfs.exe
C:\Documents and Settings\lovenut\Desktop\dds.scr
============== Pseudo HJT Report ===============
uInternet Settings,ProxyOverride = *.local
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: IEVkbdBHO Class: {59273ab4-e7d3-40f9-a1a8-6fa9cca1862c} - c:\program files\kaspersky lab\kaspersky internet security 2010\ievkbd.dll
BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\DLASHX_W.DLL
BHO: Java Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: FilterBHO Class: {e33cf602-d945-461a-83f0-819f76a199f8} - c:\program files\kaspersky lab\kaspersky internet security 2010\klwtbbho.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [ehTray] c:\windows\ehome\ehtray.exe
mRun: [lxddmon.exe] "c:\program files\lexmark 2500 series\lxddmon.exe"
mRun: [lxddamon] "c:\program files\lexmark 2500 series\lxddamon.exe"
mRun: [FaxCenterServer] "c:\program files\lexmark fax solutions\fm3032.exe" /s
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [CTHelper] CTHELPER.EXE
mRun: [CTxfiHlp] CTXFIHLP.EXE
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [DLA] c:\windows\system32\dla\DLACTRLW.EXE
mRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\ISUSPM.exe -startup
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [AVP] "c:\program files\kaspersky lab\kaspersky internet security 2010\avp.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
StartupFolder: c:\docume~1\lovenut\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\extend~1.lnk - c:\windows\ehome\RMSysTry.exe
IE: Add to Anti-Banner - c:\program files\kaspersky lab\kaspersky internet security 2010\ie_banner_deny.htm
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {4248FE82-7FCB-46AC-B270-339F08212110} - {4248FE82-7FCB-46AC-B270-339F08212110} - c:\program files\kaspersky lab\kaspersky internet security 2010\klwtbbho.dll
IE: {CCF151D8-D089-449F-A5A4-D9909053F20F} - {CCF151D8-D089-449F-A5A4-D9909053F20F} - c:\program files\kaspersky lab\kaspersky internet security 2010\klwtbbho.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
Notify: klogon - c:\windows\system32\klogon.dll
Notify: NavLogon - c:\windows\system32\NavLogon.dll
AppInit_DLLs: c:\progra~1\kasper~1\kasper~1\mzvkbd3.dll,c:\progra~1\kasper~1\kasper~1\kloehk.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
STS: HepyxidaJgm.Hepyxida: {9832037d-6e51-4dcc-b197-1fe39cd09784} - c:\windows\system32\hepyxida.dll
================= FIREFOX ===================
FF - ProfilePath - c:\docume~1\lovenut\applic~1\mozilla\firefox\profiles\zefsrtg1.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com
FF - component: c:\documents and settings\lovenut\application data\mozilla\firefox\profiles\zefsrtg1.default\extensions\{6ac85730-7d0f-4de0-b3fa-21142dd85326}\platform\winnt\components\ColorZilla.dll
FF - component: c:\documents and settings\lovenut\application data\mozilla\firefox\profiles\zefsrtg1.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\winnt_x86-msvc\components\ipc.dll
FF - component: c:\program files\mozilla firefox\extensions\linkfilter@kaspersky.ru\components\KavLinkFilter.dll
FF - plugin: c:\documents and settings\lovenut\application data\mozilla\firefox\profiles\zefsrtg1.default\extensions\moveplayer@movenetworks.com\platform\winnt_x86-msvc\plugins\npmnqmp071303000004.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true
FF - user.js: general.useragent.extra.prevx -
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
============= SERVICES / DRIVERS ===============
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2009-10-14 36880]
R1 kl1;Kl1;c:\windows\system32\drivers\kl1.sys [2009-9-1 128016]
R1 KLIF;Kaspersky Lab Driver;c:\windows\system32\drivers\klif.sys [2010-1-18 315408]
R2 AVP;Kaspersky Internet Security;c:\program files\kaspersky lab\kaspersky internet security 2010\avp.exe [2009-10-20 340456]
R2 lxdd_device;lxdd_device;c:\windows\system32\lxddcoms.exe -service --> c:\windows\system32\lxddcoms.exe -service [?]
R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\McrdSvc.exe [2005-10-20 96256]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2009-9-14 32272]
R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\drivers\klmouflt.sys [2009-10-2 19472]
S2 lxddCATSCustConnectService;lxddCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxddserv.exe [2008-12-24 99248]
=============== Created Last 30 ================
2010-01-21 09:41:36 0 d-----w- C:\XPSP2
2010-01-21 09:41:01 0 d-----w- C:\XPCD
2010-01-20 10:57:51 247808 ----a-w- c:\windows\system32\drivers\kav_iastor.sys
2010-01-20 10:31:29 0 d-----w- c:\docume~1\alluse~1\applic~1\RegAce
2010-01-20 10:31:27 0 d-----w- c:\program files\RegAce
2010-01-20 10:13:34 53136 ----a-w- c:\windows\system32\PxSecure.dll-572468
2010-01-20 09:50:51 0 d-----w- c:\windows\system32\vmm32
2010-01-19 04:06:53 95259 ----a-w- c:\windows\system32\drivers\klick.dat
2010-01-19 04:06:53 108059 ----a-w- c:\windows\system32\drivers\klin.dat
2010-01-19 04:05:57 0 d-----w- c:\program files\Kaspersky Lab
2010-01-19 04:05:57 0 d-----w- c:\docume~1\alluse~1\applic~1\Kaspersky Lab
2010-01-19 03:58:57 0 d-----w- c:\docume~1\alluse~1\applic~1\Kaspersky Lab Setup Files
2010-01-19 02:35:17 526 ----a-w- c:\windows\system32\.crusader
2010-01-19 02:35:17 234 ----a-w- c:\windows\system32\bootdelete.lst
2010-01-19 02:35:17 12872 ----a-w- c:\windows\system32\bootdelete.exe
2010-01-19 02:32:31 15944 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys
2010-01-19 02:32:26 0 d-----w- c:\program files\Hitman Pro 3.5
2010-01-19 02:32:26 0 d-----w- c:\docume~1\alluse~1\applic~1\Hitman Pro
2010-01-19 01:25:17 0 d-----w- c:\docume~1\lovenut\applic~1\Malwarebytes
2010-01-19 01:25:13 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-19 01:25:11 0 d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
2010-01-19 01:25:10 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-01-19 01:25:10 0 d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-01-18 22:29:15 0 d-----w- c:\program files\Spybot - Search & Destroy
2010-01-18 22:29:15 0 d-----w- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
2010-01-18 20:21:16 0 d-----w- c:\program files\CCleaner
2010-01-13 17:34:00 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll
==================== Find3M ====================
2009-12-20 20:44:44 34068 ----a-w- c:\windows\fonts\Wild Script.ttf
2009-10-29 07:46:59 832512 ----a-w- c:\windows\system32\wininet.dll
2009-10-29 07:46:52 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-10-29 07:46:50 17408 ------w- c:\windows\system32\corpol.dll
============= FINISH: 2:03:44.98 ===============
Full Scan: stopped 2 days ago (events: 3, objects: 1, time: 00:00:47)
1/18/2010 8:29:54 PM Task stopped
1/18/2010 8:29:08 PM Detected: Rootkit.Win32.TDSS.d System Memory
1/18/2010 8:29:07 PM Task started
Disinfect active threats: completed 2 days ago (events: 5, objects: 3318, time: 00:00:55)
1/18/2010 8:30:49 PM Task completed
1/18/2010 8:30:00 PM Untreated: Rootkit.Win32.TDSS.d System Memory Skipped by user
1/18/2010 8:30:00 PM Untreated: Rootkit.Win32.TDSS.d System Memory Cannot be disinfected
1/18/2010 8:29:54 PM Detected: Rootkit.Win32.TDSS.d System Memory
1/18/2010 8:29:54 PM Task started
Full Scan: stopped 2 days ago (events: 3, objects: 2, time: 00:01:30)
1/18/2010 8:34:34 PM Task stopped
1/18/2010 8:34:03 PM Detected: Rootkit.Win32.TDSS.d System Memory
1/18/2010 8:33:04 PM Task started
Disinfect active threats: completed 2 days ago (events: 5, objects: 3177, time: 00:00:32)
1/18/2010 8:34:34 PM Task started
1/18/2010 8:34:34 PM Detected: Rootkit.Win32.TDSS.d System Memory
1/18/2010 8:34:48 PM Untreated: Rootkit.Win32.TDSS.d System Memory Cannot be disinfected
1/18/2010 8:34:48 PM Untreated: Rootkit.Win32.TDSS.d System Memory Skipped by user
1/18/2010 8:35:07 PM Task completed
Full Scan: stopped 2 days ago (events: 5, objects: 11311, time: 00:06:09)
1/18/2010 8:37:43 PM Task started
1/18/2010 8:37:44 PM Detected: Rootkit.Win32.TDSS.d System Memory
1/18/2010 8:38:58 PM Untreated: Rootkit.Win32.TDSS.d System Memory Cannot be disinfected
1/18/2010 8:38:58 PM Untreated: Rootkit.Win32.TDSS.d System Memory Skipped by user
1/18/2010 8:43:53 PM Task stopped
Full Scan: stopped 2 days ago (events: 3, objects: 4, time: 00:00:07)
1/18/2010 8:55:16 PM Task stopped
1/18/2010 8:55:11 PM Detected: Rootkit.Win32.TDSS.d System Memory
1/18/2010 8:55:09 PM Task started
Disinfect active threats: completed 2 days ago (events: 7, objects: 3026, time: 00:00:28)
1/18/2010 8:55:44 PM Task completed
1/18/2010 8:55:18 PM Disinfected: Rootkit.Win32.TDSS.d System Memory
1/18/2010 8:55:18 PM Disinfected: Rootkit.Win32.TDSS.d System Memory
1/18/2010 8:55:17 PM Cannot be backed up: Rootkit.Win32.TDSS.y Unknown application
1/18/2010 8:55:16 PM Detected: Rootkit.Win32.TDSS.y Unknown application
1/18/2010 8:55:16 PM Detected: Rootkit.Win32.TDSS.d System Memory
1/18/2010 8:55:16 PM Task started
Full Scan: completed 2 days ago (events: 8, objects: 308863, time: 00:58:10)
1/18/2010 8:57:35 PM Task started
1/18/2010 8:57:37 PM Detected: Rootkit.Win32.TDSS.d System Memory
1/18/2010 8:57:56 PM Untreated: Rootkit.Win32.TDSS.d System Memory Cannot be disinfected
1/18/2010 8:57:56 PM Untreated: Rootkit.Win32.TDSS.d System Memory Skipped by user
1/18/2010 9:54:35 PM Detected: Rootkit.Win32.TDSS.y c:\WINDOWS\system32\drivers\kav_iastor.sys
1/18/2010 9:54:38 PM Untreated: Rootkit.Win32.TDSS.y c:\WINDOWS\system32\drivers\kav_iastor.sys Cannot be disinfected
1/18/2010 9:55:45 PM Deleted: Rootkit.Win32.TDSS.y c:\WINDOWS\system32\drivers\kav_iastor.sys
1/18/2010 9:55:46 PM Task completed
Rootkit Scan: completed 2 days ago (events: 2, objects: 651, time: 00:03:54)
1/18/2010 10:01:16 PM Task completed
1/18/2010 9:57:22 PM Task started
Rootkit Scan: completed 1 day ago (events: 2, objects: 668, time: 00:04:44)
1/19/2010 11:13:08 AM Task completed
1/19/2010 11:08:24 AM Task started
Objects Scan: stopped 1 day ago (events: 2, objects: 11, time: 00:00:05)
1/19/2010 8:04:07 PM Task stopped
1/19/2010 8:04:02 PM Task started
Objects Scan: stopped 23 hours ago (events: 2, objects: 3112, time: 00:00:49)
1/20/2010 2:57:28 AM Task stopped
1/20/2010 2:56:39 AM Task started
Full Scan: stopped 23 hours ago (events: 3, objects: 2, time: 00:00:15)
1/20/2010 2:57:46 AM Task stopped
1/20/2010 2:57:33 AM Detected: Rootkit.Win32.TDSS.d System Memory
1/20/2010 2:57:31 AM Task started
Disinfect active threats: completed 23 hours ago (events: 7, objects: 3272, time: 00:00:51)
1/20/2010 2:57:46 AM Task started
1/20/2010 2:57:46 AM Detected: Rootkit.Win32.TDSS.d System Memory
1/20/2010 2:57:49 AM Detected: Rootkit.Win32.TDSS.y Unknown application
1/20/2010 2:57:49 AM Cannot be backed up: Rootkit.Win32.TDSS.y Unknown application
1/20/2010 2:57:51 AM Disinfected: Rootkit.Win32.TDSS.d System Memory
1/20/2010 2:57:51 AM Disinfected: Rootkit.Win32.TDSS.d System Memory
1/20/2010 2:58:37 AM Task completed
Full Scan: stopped 23 hours ago (events: 5, objects: 993, time: 00:00:22)
1/20/2010 3:00:18 AM Task started
1/20/2010 3:00:20 AM Detected: Rootkit.Win32.TDSS.d System Memory
1/20/2010 3:00:30 AM Untreated: Rootkit.Win32.TDSS.d System Memory Cannot be disinfected
1/20/2010 3:00:30 AM Untreated: Rootkit.Win32.TDSS.d System Memory Skipped by user
1/20/2010 3:00:40 AM Task stopped
Rootkit Scan: completed 15 hours ago (events: 2, objects: 651, time: 00:04:33)
1/20/2010 11:05:12 AM Task completed
1/20/2010 11:00:39 AM Task started