Let's see if your computer is fully clean now...I think we are done.

ESET Online Scan

Please run a free online scan with the ESET Online Scanner

• Tick the box next to YES, I accept the Terms of Use
  
• Click Start
  
• When asked, allow the ActiveX control to install
  
• Click Start
  
• Make sure that the options Remove found threats and the option Scan unwanted applications is checked
  
• Click Scan (This scan can take several hours, so please be patient)
  
• Once the scan is completed, you may close the window
  
• Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
  
• Copy and paste that log as a reply to this topic

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# IEXPLORE.EXE=6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=82d8e04d7f1de8419c0466a5f4a9378d
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2010-08-25 01:48:41
# local_time=2010-08-25 09:48:41 (+0800, Taipei Standard Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 2
# compatibility_mode=8192 67108863 100 0 2123 2123 0 0
# scanned=73449
# found=116
# cleaned=116
# scan_time=1213
C:\Qoobox\Quarantine\D\autorun.inf.vir Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Qoobox\Quarantine\D\krwyrv0d.exe.vir Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP10\A0015526.exe Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP10\A0015527.inf Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP10\A0015547.exe Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP10\A0015548.inf Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP10\A0015564.exe Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP10\A0015565.inf Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP10\A0015585.exe Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP10\A0015586.inf Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP10\A0015600.exe Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP10\A0015601.inf Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP11\A0015612.exe Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP11\A0015613.inf Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP11\A0016600.exe Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP11\A0016601.inf Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP11\A0016614.exe Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP11\A0016615.inf Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP11\A0016629.exe Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP11\A0016630.inf Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP11\A0016647.exe Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP11\A0016648.inf Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP11\A0016664.exe Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP11\A0016665.inf Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP11\A0016680.exe Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP11\A0016681.inf Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP12\A0016689.exe Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP12\A0016690.inf Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP12\A0016709.exe Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP12\A0016710.inf Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP12\A0016727.exe Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP12\A0016728.inf Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP12\A0017742.exe Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP12\A0017743.inf Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP12\A0017763.exe Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP12\A0017764.inf Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP13\A0017776.exe Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP13\A0017777.inf Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP13\A0018763.exe Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP13\A0018764.inf Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP13\A0019792.exe Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP13\A0019793.inf Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP14\A0019805.exe Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP14\A0019806.inf Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP14\A0019829.exe Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP14\A0019830.inf Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP14\A0019854.exe Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP14\A0019855.inf Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP14\A0019870.exe Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP14\A0019871.inf Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP14\A0019890.exe Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP14\A0019891.inf Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP14\A0019906.exe Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP14\A0019907.inf Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP14\A0019922.exe Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP14\A0019923.inf Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP14\A0019938.exe Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP14\A0019939.inf Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP14\A0019960.exe Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP14\A0019961.inf Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP14\A0019985.exe Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP14\A0019986.inf Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP14\A0020007.exe Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP14\A0020008.inf Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP14\A0020026.exe Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP14\A0020027.inf Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP14\A0020050.exe Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP14\A0020051.inf Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP14\A0021066.exe Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP14\A0021067.inf Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP14\A0021084.exe Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP14\A0021085.inf Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP14\A0021105.exe Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP14\A0021106.inf Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP14\A0021126.exe Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP14\A0021127.inf Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP14\A0021142.exe Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP14\A0021143.inf Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP14\A0021160.exe Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP14\A0021161.inf Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP14\A0021176.exe Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP14\A0021177.inf Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP15\A0021188.exe Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP15\A0021189.inf Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP16\A0021286.exe Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP16\A0021287.inf Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP16\A0021336.dll probably a variant of Win32/Genetik trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP17\A0021466.exe Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP17\A0021467.inf Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP17\A0021541.exe Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP17\A0021542.inf Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP18\A0022551.exe Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP18\A0022552.inf Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP18\A0023541.exe Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP18\A0023542.inf Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP7\A0014383.exe Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP7\A0014384.inf Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP8\A0014391.exe Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP8\A0014392.inf Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP8\A0015383.exe Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP8\A0015384.inf Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP8\A0015403.exe Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP8\A0015404.inf Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP8\A0015419.exe Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP8\A0015420.inf Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP9\A0015428.exe Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP9\A0015429.inf Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP9\A0015446.exe Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP9\A0015447.inf Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP9\A0015468.exe Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP9\A0015469.inf Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP9\A0015490.exe Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP9\A0015491.inf Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP9\A0015515.exe Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP9\A0015516.inf Win32/PSW.OnLineGames.OUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\ACERS-SYPE-COMET-SOFEE-ACES.vbs VBS/AutoRun.FD worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=82d8e04d7f1de8419c0466a5f4a9378d
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2010-08-25 02:45:14
# local_time=2010-08-25 10:45:14 (+0800, Taipei Standard Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 2
# compatibility_mode=8192 67108863 100 0 5521 5521 0 0
# scanned=73414
# found=1
# cleaned=1
# scan_time=1210
C:\System Volume Information\_restore{052B696E-E036-4824-9CBC-D707E1B8F87B}\RP21\A0029232.vbs VBS/AutoRun.FD worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
# version=7
# IEXPLORE.EXE=6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=82d8e04d7f1de8419c0466a5f4a9378d
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2010-08-26 01:45:48
# local_time=2010-08-26 09:45:48 (+0800, Taipei Standard Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 2
# compatibility_mode=8192 67108863 100 0 88343 88343 0 0
# scanned=73616
# found=0
# cleaned=0
# scan_time=1221

Now how is it running?

Hi again. As for my laptop, I think something is wrong since it hangs often or everytime I use it. All I have to do is just to long-press the power button. I cant really tell why or what's causing it since it occurs in no pattern. Also, my avira is not working properly. I can't update it. I tried installing a new version to no avail.

And for my desktop. I don't frequently use it but what I noticed is that I lost my internet connection in about 15 mins of first using it and the only way to restore the connection is by restarting every time I lose the connection. It happens not even during peak hours.

On the Desktop, do you use a network for it, or is it connected directly to the internet?

===

For the laptop:

Download SuperAntiSpyware

• Load SuperAntiSpyware and click the Check for updates button.
  
• Once the update is finished click the Scan your computer button.
  
• Check Perform Complete Scan and then next.
  
• SuperAntiSpyware will now scan your computer and when its finished it will list all the infections it has found.
  
• Make sure that they all have a check next to them and press next.
  
• Click finish and you will be taken back to the main interface.
  
• Click Preferences and then click the statistics/logs tab. Click the dated log and press view log and a text file will appear.
  
• Copy and paste the log onto the forum.
  

Hi. As for the desktop, Im connecting directly to the internet via wireless broadband. Below is the log of SuperAntiSpyware.

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 09/06/2010 at 11:14 PM

Application Version : 4.42.1000

Core Rules Database Version : 5459
Trace Rules Database Version: 3271

Scan type : Complete Scan
Total Scan Time : 00:35:44

Memory items scanned : 500
Memory threats detected : 0
Registry items scanned : 5265
Registry threats detected : 0
File items scanned : 28372
File threats detected : 15

Adware.Tracking Cookie
C:\Documents and Settings\Nica\Cookies\nica@content.yieldmanager[1].txt
C:\Documents and Settings\Nica\Cookies\nica@doubleclick[2].txt
C:\Documents and Settings\Nica\Cookies\nica@ak[2].txt
C:\Documents and Settings\Nica\Cookies\nica@revsci[2].txt
C:\Documents and Settings\Nica\Cookies\nica@atdmt[1].txt
C:\Documents and Settings\Nica\Cookies\nica@yieldmanager[1].txt
C:\Documents and Settings\Nica\Cookies\nica@interclick[1].txt
C:\Documents and Settings\Nica\Cookies\nica@tribalfusion[2].txt
C:\Documents and Settings\Nica\Cookies\nica@overture[2].txt
C:\Documents and Settings\Nica\Cookies\nica@fastclick[1].txt
C:\Documents and Settings\Nica\Cookies\nica@apmebf[1].txt
C:\Documents and Settings\Nica\Cookies\nica@bs.serving-sys[1].txt
C:\Documents and Settings\Nica\Cookies\nica@serving-sys[1].txt
C:\Documents and Settings\Nica\Cookies\nica@ad.yieldmanager[1].txt
ia.media-imdb.com [ C:\Documents and Settings\Nica\Application Data\Macromedia\Flash Player\#SharedObjects\KUECTBW7 ]

Power cycle the router and modem and tell me if it works.

See here for tutorial: http://www.ehow.com/how_4904127_power-cycle-reset-modem-router.html

hi. ive tried the provided instructions. currently, im not encountering internet disconnection, and hopefully never will

How are the computers working overall, now?

my laptop stills hangs and i still cant update my avira. i tried downloading other versions from different websites but its still not working well.

as for the desktop, i scanned the whole pc using eset online scanner and malwarebytes. at first, both were able to detect malwares, i checked all detected files then removed. After which, I installed avira, updated it and scanned the entire pc but I was able to detect again malwares. The BDS.small iuj was still detected so after the scan, I didnt do any action.

Let's stay with the Desktop for now...

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

• Double-click SystemLook.exe to run it.
  
• Copy the content of the following codebox into the main textfield:
  

  Code:

  :filefind
tcpip.sys
explorer.exe


  
  
  
• Click the Look button to start the scan.
  
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
  

Note: The log can also be found on your Desktop entitled SystemLook.txt

SystemLook 04.09.10 by jpshortstuff
Log created at 21:59 on 09/09/2010 by Monica
Administrator - Elevation successful

========== filefind ==========

Searching for "tcpip.sys"
C:\WINDOWS\system32\drivers\tcpip.sys --a---- 360448 bytes [02:03 13/01/2006] [02:03 13/01/2006] 2A4818AEA80ACD2C95D7D92D2F3155F8

Searching for "explorer.exe"
C:\WINDOWS\explorer.exe --a---- 1033216 bytes [01:46 13/01/2006] [09:44 22/08/2010] 97BD6515465659FF8F3B7BE375B2EA87

-= EOF =-

Before we disinfect explorer.exe, I want to check something out...

Please download 7-Zip and install it. If you already have it, no need to reinstall.

Then, download RootkitUnhooker and save the setup to your Desktop.

• Right-click on the RootkitUnhooker setup and mouse-over 7-Zip then click Extract to "RKU***"
  
• Once that is done, enter the folder, and double-click on the setup file. Navigate through setup and finish.
  
• Once that is done, you will see another folder that was created inside the RKU folder. Enter that folder, and double-click on the randomly named file. (It will be alpha-numeric and have an EXE extension on it.)
  
• It will initialize itself and load the scanner. It will also install its driver. Please wait for the interface to begin.
  
• Once inside the interface, do not fix anything. Click on the Report tab.
  
• Next, click on the Scan button and a popup will show. Make sure all are checked, then click on OK. It will begin scanning. When it gets to the Files tab, it will ask you what drives to scan. Just select C:\ and hit OK.
  
• It will finish in about 5 minutes or a little longer depending on how badly infected the system is, or if your security software is enabled.
  
• When finished, it will show the report in the Report tab. Please copy all of it, and post it in your next reply. Depending on how large the log is, you may have to use two or three posts to get all the information in.

RkU Version: 3.8.388.590, Type LE (SR2)
==============================================
OS Name: Windows XP
Version 5.1.2600 (Service Pack 2)
Number of processors #2
==============================================
>SSDT State
==============================================
ntkrnlpa.exe-->NtCreateKey, Type: Address change 0x8062209E-->F7C36D7E [Unknown module filename]
ntkrnlpa.exe-->NtCreateThread, Type: Address change 0x805CF83E-->F7C36D74 [Unknown module filename]
ntkrnlpa.exe-->NtDeleteKey, Type: Address change 0x8062252E-->F7C36D83 [Unknown module filename]
ntkrnlpa.exe-->NtDeleteValueKey, Type: Address change 0x806226FE-->F7C36D8D [Unknown module filename]
ntkrnlpa.exe-->NtLoadKey, Type: Address change 0x80623DCE-->F7C36D92 [Unknown module filename]
ntkrnlpa.exe-->NtOpenProcess, Type: Address change 0x805C9C80-->F7C36D60 [Unknown module filename]
ntkrnlpa.exe-->NtOpenThread, Type: Address change 0x805C9F0C-->F7C36D65 [Unknown module filename]
ntkrnlpa.exe-->NtReplaceKey, Type: Address change 0x80623C7E-->F7C36D9C [Unknown module filename]
ntkrnlpa.exe-->NtRestoreKey, Type: Address change 0x806204A6-->F7C36D97 [Unknown module filename]
ntkrnlpa.exe-->NtSetValueKey, Type: Address change 0x8062075E-->F7C36D88 [Unknown module filename]
==============================================
>Shadow
==============================================
==============================================
>Processes
==============================================
0x859C4A00 [4] System
0x856E9848 [192] C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation, Firefox)
0x8559B808 [324] C:\Program Files\Sun Broadband Wireless\Sun Broadband Wireless.exe
0x85767C10 [372] C:\WINDOWS\system32\smss.exe (Microsoft Corporation, Windows NT Session Manager)
0x8586DDA0 [428] C:\WINDOWS\system32\csrss.exe (Microsoft Corporation, Client Server Runtime Process)
0x854FACD0 [452] C:\WINDOWS\system32\winlogon.exe (Microsoft Corporation, Windows NT Logon Application)
0x8557DDA0 [496] C:\WINDOWS\system32\services.exe (Microsoft Corporation, Services and Controller app)
0x856CED38 [508] C:\WINDOWS\system32\lsass.exe (Microsoft Corporation, LSA Shell (Export Version))
0x85906BE8 [684] C:\WINDOWS\system32\svchost.exe (Microsoft Corporation, Generic Host Process for Win32 Services)
0x854D9DA0 [820] C:\WINDOWS\system32\svchost.exe (Microsoft Corporation, Generic Host Process for Win32 Services)
0x85875020 [860] C:\WINDOWS\system32\svchost.exe (Microsoft Corporation, Generic Host Process for Win32 Services)
0x851A89E0 [888] C:\WINDOWS\system32\wbem\wmiprvse.exe (Microsoft Corporation, WMI)
0x85715020 [924] C:\WINDOWS\system32\svchost.exe (Microsoft Corporation, Generic Host Process for Win32 Services)
0x8586EA20 [992] C:\WINDOWS\system32\svchost.exe (Microsoft Corporation, Generic Host Process for Win32 Services)
0x854ECA70 [1080] C:\WINDOWS\system32\spoolsv.exe (Microsoft Corporation, Spooler SubSystem App)
0x855BE1F8 [1120] C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH, Antivirus Scheduler)
0x8580A8F8 [1316] C:\WINDOWS\explorer.exe (Microsoft Corporation, Windows Explorer)
0x85727B80 [1332] C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH, Antivirus On-Access Service)
0x8550D408 [1388] C:\Program Files\Ahead\InCD\incdsrv.exe (AHEAD Software, incdsrv)
0x8556A818 [1448] C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc., Java(TM) Quick Starter Service)
0x8559DDA0 [1556] C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH, AntiVir shadow copy service)
0x855E42F8 [1644] C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc., AutoUpater Service Module)
0x85744020 [1748] C:\Program Files\Ahead\InCD\InCD.exe (Ahead Software AG, InCD)
0x85748BC0 [1772] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH, Antivirus System Tray Tool)
0x855846B8 [1788] C:\Program Files\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc., Java(TM) Update Scheduler)
0x856BF648 [1888] C:\Documents and Settings\Monica\Desktop\LimeWire\LimeWire.exe (Lime Wire, LLC, LimeWire)
0x85579440 [2112] C:\WINDOWS\system32\alg.exe (Microsoft Corporation, Application Layer Gateway Service)
0x851C6680 [2768] C:\Documents and Settings\Monica\Desktop\RkU3.8.388.590\MustBeRandomlyNamed\5fHTQV.exe (UG North, RKULE, SR2 Normandy)
0x85243BF0 [3056] C:\PROGRA~1\Yahoo!\Messenger\Ymsgr_tray.exe (Yahoo! Inc., Yahoo! Messenger Tray)
0x8538E7E0 [3156] C:\Program Files\Mozilla Firefox\plugin-container.exe (Mozilla Corporation, Plugin Container for Firefox)
0x85212DA0 [3204] C:\WINDOWS\system32\wscntfy.exe (Microsoft Corporation, Windows Security Center Notification App)
0x851E9A28 [3476] C:\WINDOWS\system32\wuauclt.exe (Microsoft Corporation, Automatic Updates)
==============================================
>Drivers
==============================================
0x804D7000 C:\WINDOWS\system32\ntkrnlpa.exe 2142208 bytes (Microsoft Corporation, NT Kernel & System)
0x804D7000 PnpManager 2142208 bytes
0x804D7000 RAW 2142208 bytes
0x804D7000 WMIxWDM 2142208 bytes
0xBF800000 Win32k 1843200 bytes
0xBF800000 C:\WINDOWS\System32\win32k.sys 1843200 bytes (Microsoft Corporation, Multi-User Win32 Driver)
0xF726D000 Ntfs.sys 577536 bytes (Microsoft Corporation, NT File System Driver)
0xF6EAE000 C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 454656 bytes (Microsoft Corporation, Windows NT SMB Minirdr)
0xF6FB3000 C:\WINDOWS\system32\DRIVERS\tcpip.sys 360448 bytes (Microsoft Corporation, TCP/IP Protocol Driver)
0xF63E5000 C:\WINDOWS\system32\DRIVERS\srv.sys 335872 bytes (Microsoft Corporation, Server driver)
0xF5F94000 C:\WINDOWS\System32\Drivers\HTTP.sys 266240 bytes (Microsoft Corporation, HTTP Protocol Stack)
0xF70BE000 C:\WINDOWS\system32\DRIVERS\update.sys 212992 bytes (Microsoft Corporation, Update Driver)
0xF713D000 C:\WINDOWS\system32\DRIVERS\rdpdr.sys 200704 bytes (Microsoft Corporation, Microsoft RDP Device redirector)
0xF73B0000 ACPI.sys 188416 bytes (Microsoft Corporation, ACPI Driver for NT)
0xF65C7000 C:\WINDOWS\system32\DRIVERS\mrxdav.sys 184320 bytes (Microsoft Corporation, Windows NT WebDav Minirdr)
0xF7240000 NDIS.sys 184320 bytes (Microsoft Corporation, NDIS 5.1 wrapper driver)
0xF6F1D000 C:\WINDOWS\system32\DRIVERS\rdbss.sys 176128 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver)
0xF6F8B000 C:\WINDOWS\system32\DRIVERS\netbt.sys 163840 bytes (Microsoft Corporation, MBT Transport driver)
0xF6437000 C:\WINDOWS\system32\DRIVERS\secdrv.sys 163840 bytes (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K., Macrovision SECURITY Driver)
0xF735A000 dmio.sys 155648 bytes (Microsoft Corp., Veritas Software, NT Disk Manager I/O Driver)
0xF7196000 C:\WINDOWS\system32\DRIVERS\HDAudBus.sys 151552 bytes (Windows (R) Server 2003 DDK provider, High Definition Audio Bus Driver v1.0a)
0xF70F2000 C:\WINDOWS\system32\DRIVERS\ks.sys 143360 bytes (Microsoft Corporation, Kernel CSA Library)
0xF71BB000 C:\WINDOWS\system32\DRIVERS\USBPORT.SYS 143360 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver)
0xF6F48000 C:\WINDOWS\System32\drivers\afd.sys 139264 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock)
0xF6DEC000 C:\WINDOWS\system32\DRIVERS\avipbb.sys 139264 bytes (Avira GmbH, Avira Driver for Security Enhancement)
0xF6F6A000 C:\WINDOWS\system32\DRIVERS\ipnat.sys 135168 bytes (Microsoft Corporation, IP Network Address Translator)
0x806E2000 ACPI_HAL 134272 bytes
0x806E2000 C:\WINDOWS\system32\hal.dll 134272 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL)
0xF7323000 fltMgr.sys 126976 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager)
0xF7380000 ftdisk.sys 126976 bytes (Microsoft Corporation, FT Disk Driver)
0xF67D4000 C:\WINDOWS\system32\DRIVERS\ewusbmdm.sys 106496 bytes (Huawei Technologies Co., Ltd., USB Modem/Serial Device Driver)
0xF7226000 Mup.sys 106496 bytes (Microsoft Corporation, Multiple UNC Provider driver)
0xF6DD3000 C:\WINDOWS\system32\DRIVERS\ewusbdev.sys 102400 bytes (Huawei Technologies Co., Ltd., USB Modem/Serial Device Driver)
0xF7342000 atapi.sys 98304 bytes (Microsoft Corporation, IDE/ATAPI Port Driver)
0xF6D93000 C:\WINDOWS\System32\Drivers\dump_atapi.sys 98304 bytes
0xF72FA000 KSecDD.sys 94208 bytes (Microsoft Corporation, Kernel Security Support Provider Interface)
0xF717F000 C:\WINDOWS\system32\DRIVERS\ndiswan.sys 94208 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption))
0xF683E000 C:\WINDOWS\system32\DRIVERS\avgntflt.sys 86016 bytes (Avira GmbH, Avira Minifilter Driver)
0xF701E000 C:\WINDOWS\System32\Drivers\InCDfs.SYS 86016 bytes (Ahead Software, InCD File System Driver)
0xF7053000 C:\WINDOWS\System32\drivers\VIDEOPRT.SYS 81920 bytes (Microsoft Corporation, Video Port Driver)
0xF700B000 C:\WINDOWS\system32\DRIVERS\ipsec.sys 77824 bytes (Microsoft Corporation, IPSec Driver)
0xBF9C2000 C:\WINDOWS\System32\drivers\dxg.sys 73728 bytes (Microsoft Corporation, DirectX Graphics Driver)
0xF7311000 sr.sys 73728 bytes (Microsoft Corporation, System Restore Filesystem Filter Driver)
0xF739F000 pci.sys 69632 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator)
0xF716E000 C:\WINDOWS\system32\DRIVERS\psched.sys 69632 bytes (Microsoft Corporation, MS QoS Packet Scheduler)
0xF5EDC000 C:\WINDOWS\System32\Drivers\Cdfs.SYS 65536 bytes (Microsoft Corporation, CD-ROM File System Driver)
0xF761F000 C:\WINDOWS\system32\DRIVERS\serial.sys 65536 bytes (Microsoft Corporation, Serial Device Driver)
0xF769F000 C:\WINDOWS\system32\DRIVERS\usbhub.sys 61440 bytes (Microsoft Corporation, Default Hub Driver for USB)
0xF5C0C000 C:\WINDOWS\system32\DRIVERS\cdrom.sys 53248 bytes (Microsoft Corporation, SCSI CD-ROM Driver)
0xF751F000 C:\WINDOWS\system32\DRIVERS\CLASSPNP.SYS 53248 bytes (Microsoft Corporation, SCSI Class System Dll)
0xF762F000 C:\WINDOWS\system32\DRIVERS\i8042prt.sys 53248 bytes (Microsoft Corporation, i8042 Port Driver)
0xF763F000 C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 53248 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver)
0xF74FF000 VolSnap.sys 53248 bytes (Microsoft Corporation, Volume Shadow Copy Driver)
0xF765F000 C:\WINDOWS\system32\DRIVERS\raspptp.sys 49152 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol)
0xF74EF000 MountMgr.sys 45056 bytes (Microsoft Corporation, Mount Manager)
0xF764F000 C:\WINDOWS\system32\DRIVERS\raspppoe.sys 45056 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver)
0xF768F000 C:\WINDOWS\System32\Drivers\NDProxy.SYS 40960 bytes (Microsoft Corporation, NDIS Proxy)
0xF767F000 C:\WINDOWS\system32\DRIVERS\termdd.sys 40960 bytes (Microsoft Corporation, Terminal Server Driver)
0xF750F000 disk.sys 36864 bytes (Microsoft Corporation, PnP Disk Driver)
0xF76FF000 C:\WINDOWS\System32\Drivers\Fips.SYS 36864 bytes (Microsoft Corporation, FIPS Crypto Driver)
0xF773F000 C:\WINDOWS\system32\DRIVERS\HIDCLASS.SYS 36864 bytes (Microsoft Corporation, Hid Class Library)
0xF760F000 C:\WINDOWS\system32\DRIVERS\intelppm.sys 36864 bytes (Microsoft Corporation, Processor Device Driver)
0xF74DF000 isapnp.sys 36864 bytes (Microsoft Corporation, PNP ISA Bus Driver)
0xF766F000 C:\WINDOWS\system32\DRIVERS\msgpc.sys 36864 bytes (Microsoft Corporation, MS General Packet Classifier)
0xF76CF000 C:\WINDOWS\system32\DRIVERS\netbios.sys 36864 bytes (Microsoft Corporation, NetBIOS interface driver)
0xF676C000 C:\WINDOWS\System32\Drivers\Normandy.SYS 36864 bytes (RKU Driver)
0xF76BF000 C:\WINDOWS\system32\DRIVERS\wanarp.sys 36864 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver)
0xF783F000 C:\WINDOWS\System32\Drivers\Modem.SYS 32768 bytes (Microsoft Corporation, Modem Device Driver)
0xF78C7000 C:\WINDOWS\System32\Drivers\Npfs.SYS 32768 bytes (Microsoft Corporation, NPFS Driver)
0xF7827000 C:\WINDOWS\system32\DRIVERS\usbccgp.sys 32768 bytes (Microsoft Corporation, USB Common Class Generic Parent Driver)
0xF7777000 C:\WINDOWS\system32\DRIVERS\HIDPARSE.SYS 28672 bytes (Microsoft Corporation, Hid Parsing Library)
0xF78D7000 C:\WINDOWS\System32\DRIVERS\InCDPass.sys 28672 bytes (Ahead Software, Ahead RW Filter Driver)
0xF775F000 C:\WINDOWS\system32\DRIVERS\PCIIDEX.SYS 28672 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension)
0xF7877000 C:\WINDOWS\system32\DRIVERS\usbehci.sys 28672 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver)
0xF7837000 C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS 28672 bytes (Microsoft Corporation, USB Mass Storage Class Driver)
0xF7867000 C:\WINDOWS\system32\DRIVERS\kbdclass.sys 24576 bytes (Microsoft Corporation, Keyboard Class Driver)
0xF7897000 C:\WINDOWS\system32\DRIVERS\mouclass.sys 24576 bytes (Microsoft Corporation, Mouse Class Driver)
0xF78CF000 C:\WINDOWS\system32\DRIVERS\ssmdrv.sys 24576 bytes (Avira GmbH, AVIRA SnapShot Driver)
0xF78B7000 C:\WINDOWS\System32\drivers\vga.sys 24576 bytes (Microsoft Corporation, VGA/Super VGA Video Driver)
0xF78BF000 C:\WINDOWS\System32\Drivers\Msfs.SYS 20480 bytes (Microsoft Corporation, Mailslot driver)
0xF7767000 PartMgr.sys 20480 bytes (Microsoft Corporation, Partition Manager)
0xF7887000 C:\WINDOWS\system32\DRIVERS\ptilink.sys 20480 bytes (Parallel Technologies, Inc., Parallel Technologies DirectParallel IO Library)
0xF788F000 C:\WINDOWS\system32\DRIVERS\raspti.sys 20480 bytes (Microsoft Corporation, PTI DirectParallel(R) mini-port/call-manager driver)
0xF787F000 C:\WINDOWS\system32\DRIVERS\TDI.SYS 20480 bytes (Microsoft Corporation, TDI Wrapper)
0xF786F000 C:\WINDOWS\system32\DRIVERS\usbohci.sys 20480 bytes (Microsoft Corporation, OHCI USB Miniport Driver)
0xF77AF000 C:\WINDOWS\System32\watchdog.sys 20480 bytes (Microsoft Corporation, Watchdog Driver)
0xF5D24000 C:\WINDOWS\system32\DRIVERS\asyncmac.sys 16384 bytes (Microsoft Corporation, MS Remote Access serial network driver)
0xF79AF000 C:\WINDOWS\system32\DRIVERS\mssmbios.sys 16384 bytes (Microsoft Corporation, System Management BIOS Driver)
0xF6826000 C:\WINDOWS\system32\DRIVERS\ndisuio.sys 16384 bytes (Microsoft Corporation, NDIS User mode I/O Driver)
0xF7987000 C:\WINDOWS\system32\DRIVERS\serenum.sys 16384 bytes (Microsoft Corporation, Serial Port Enumerator)
0xF78EF000 C:\WINDOWS\system32\BOOTVID.dll 12288 bytes (Microsoft Corporation, VGA Boot Driver)
0xF7115000 C:\WINDOWS\System32\drivers\Dxapi.sys 12288 bytes (Microsoft Corporation, DirectX API Driver)
0xBFF50000 C:\WINDOWS\System32\framebuf.dll 12288 bytes (Microsoft Corporation, Framebuffer Display Driver)
0xF71EA000 C:\WINDOWS\system32\DRIVERS\hidusb.sys 12288 bytes (Microsoft Corporation, USB Miniport Driver for Input Devices)
0xF71E6000 C:\WINDOWS\system32\DRIVERS\mouhid.sys 12288 bytes (Microsoft Corporation, HID Mouse Filter Driver)
0xF798F000 C:\WINDOWS\system32\DRIVERS\ndistapi.sys 12288 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver)
0xF79D3000 C:\WINDOWS\system32\DRIVERS\rasacd.sys 12288 bytes (Microsoft Corporation, RAS Automatic Connection Driver)
0xF798B000 C:\WINDOWS\system32\DRIVERS\wmiacpi.sys 12288 bytes (Microsoft Corporation, Windows Management Interface for ACPI)
0xF7A0D000 C:\Program Files\Avira\AntiVir Desktop\avgio.sys 8192 bytes (Avira GmbH, Avira AntiVir Support for Minifilter)
0xF7A03000 C:\WINDOWS\System32\Drivers\Beep.SYS 8192 bytes (Microsoft Corporation, BEEP Driver)
0xF79E3000 dmload.sys 8192 bytes (Microsoft Corp., Veritas Software., NT Disk Manager Startup Driver)
0xF7A15000 C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS 8192 bytes
0xF7A01000 C:\WINDOWS\System32\Drivers\Fs_Rec.SYS 8192 bytes (Microsoft Corporation, File System Recognizer Driver)
0xF7A09000 C:\WINDOWS\System32\Drivers\InCDrec.SYS 8192 bytes (Ahead Software AG, InCD File System Recognizer)
0xF79DF000 C:\WINDOWS\system32\KDCOM.DLL 8192 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL)
0xF7A05000 C:\WINDOWS\System32\Drivers\mnmdd.SYS 8192 bytes (Microsoft Corporation, Frame buffer simulator)
0xF7A07000 C:\WINDOWS\System32\DRIVERS\RDPCDD.sys 8192 bytes (Microsoft Corporation, RDP Miniport)
0xF79FB000 C:\WINDOWS\system32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator)
0xF79FF000 C:\WINDOWS\system32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver)
0xF79E1000 C:\WINDOWS\system32\DRIVERS\WMILIB.SYS 8192 bytes (Microsoft Corporation, WMILIB WMI support library Dll)
0xF7BA5000 C:\WINDOWS\system32\DRIVERS\audstub.sys 4096 bytes (Microsoft Corporation, AudStub Driver)
0xF7B89000 C:\WINDOWS\System32\drivers\dxgthk.sys 4096 bytes (Microsoft Corporation, DirectX Graphics Driver Thunk)
0xF7BEA000 C:\WINDOWS\System32\Drivers\Null.SYS 4096 bytes (Microsoft Corporation, NULL Driver)
0xF7AA7000 pciide.sys 4096 bytes (Microsoft Corporation, Generic PCI IDE Bus Driver)
==============================================
>Stealth
==============================================
==============================================
>Files
==============================================
==============================================
>Hooks
==============================================
ntkrnlpa.exe+0x0002C914, Type: Inline - RelativeJump 0x80503914-->80503987 [ntkrnlpa.exe]
ntkrnlpa.exe+0x0002C944, Type: Inline - RelativeJump 0x80503944-->805039B7 [ntkrnlpa.exe]
ntkrnlpa.exe+0x0006DDDE, Type: Inline - RelativeJump 0x80544DDE-->80544DE5 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeFindConfigurationEntry, Type: Inline - RelativeJump 0x806A080E-->806A0884 [ntkrnlpa.exe]
[1316]explorer.exe-->advapi32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x77DD1610-->00000000 [shimeng.dll]
[1316]explorer.exe-->gdi32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x77F110BC-->00000000 [shimeng.dll]
[1316]explorer.exe-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x01001268-->00000000 [shimeng.dll]
[1316]explorer.exe-->shell32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x7C9C15A0-->00000000 [shimeng.dll]
[1316]explorer.exe-->user32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x77D4133C-->00000000 [shimeng.dll]
[1316]explorer.exe-->wininet.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x771B1248-->00000000 [shimeng.dll]
[1316]explorer.exe-->ws2_32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x71AB115C-->00000000 [shimeng.dll]
[192]firefox.exe-->ntdll.dll-->LdrLoadDll, Type: Inline - RelativeJump 0x7C9161CA-->00000000 [firefox.exe]
[3056]Ymsgr_tray.exe-->gdi32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x77F110BC-->00000000 [yui.dll]
[3056]Ymsgr_tray.exe-->gdi32.dll-->kernel32.dll-->LoadLibraryA, Type: IAT modification 0x77F11084-->00000000 [yui.dll]
[3056]Ymsgr_tray.exe-->gdi32.dll-->kernel32.dll-->LoadLibraryExW, Type: IAT modification 0x77F11078-->00000000 [yui.dll]
[3056]Ymsgr_tray.exe-->gdi32.dll-->kernel32.dll-->LoadLibraryW, Type: IAT modification 0x77F110C0-->00000000 [yui.dll]
[3056]Ymsgr_tray.exe-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x0040C0E4-->00000000 [yui.dll]
[3056]Ymsgr_tray.exe-->kernel32.dll-->LoadLibraryA, Type: IAT modification 0x0040C0E0-->00000000 [yui.dll]
[3056]Ymsgr_tray.exe-->kernel32.dll-->LoadLibraryExW, Type: IAT modification 0x0040C0B0-->00000000 [yui.dll]
[3056]Ymsgr_tray.exe-->kernel32.dll-->LoadLibraryW, Type: IAT modification 0x0040C0B8-->00000000 [yui.dll]
[3056]Ymsgr_tray.exe-->shell32.dll-->gdi32.dll-->GetStockObject, Type: IAT modification 0x7C9C1134-->00000000 [yui.dll]
[3056]Ymsgr_tray.exe-->shell32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x7C9C15A0-->00000000 [yui.dll]
[3056]Ymsgr_tray.exe-->shell32.dll-->kernel32.dll-->LoadLibraryA, Type: IAT modification 0x7C9C13F4-->00000000 [yui.dll]
[3056]Ymsgr_tray.exe-->shell32.dll-->kernel32.dll-->LoadLibraryExA, Type: IAT modification 0x7C9C1638-->00000000 [yui.dll]
[3056]Ymsgr_tray.exe-->shell32.dll-->kernel32.dll-->LoadLibraryExW, Type: IAT modification 0x7C9C1618-->00000000 [yui.dll]
[3056]Ymsgr_tray.exe-->shell32.dll-->kernel32.dll-->LoadLibraryW, Type: IAT modification 0x7C9C159C-->00000000 [yui.dll]
[3056]Ymsgr_tray.exe-->shell32.dll-->user32.dll-->AnimateWindow, Type: IAT modification 0x7C9C1D14-->00000000 [yui.dll]
[3056]Ymsgr_tray.exe-->shell32.dll-->user32.dll-->DefWindowProcA, Type: IAT modification 0x7C9C1D44-->00000000 [yui.dll]
[3056]Ymsgr_tray.exe-->shell32.dll-->user32.dll-->DefWindowProcW, Type: IAT modification 0x7C9C1EA0-->00000000 [yui.dll]
[3056]Ymsgr_tray.exe-->shell32.dll-->user32.dll-->GetSysColor, Type: IAT modification 0x7C9C1E38-->00000000 [yui.dll]
[3056]Ymsgr_tray.exe-->shell32.dll-->user32.dll-->GetSysColorBrush, Type: IAT modification 0x7C9C1EE0-->00000000 [yui.dll]
[3056]Ymsgr_tray.exe-->shell32.dll-->user32.dll-->TrackPopupMenu, Type: IAT modification 0x7C9C1F8C-->00000000 [yui.dll]
[3056]Ymsgr_tray.exe-->shell32.dll-->user32.dll-->TrackPopupMenuEx, Type: IAT modification 0x7C9C1D30-->00000000 [yui.dll]
[3056]Ymsgr_tray.exe-->user32.dll-->DefWindowProcW, Type: IAT modification 0x0040C268-->00000000 [yui.dll]
[3056]Ymsgr_tray.exe-->user32.dll-->gdi32.dll-->GetStockObject, Type: IAT modification 0x77D4112C-->00000000 [yui.dll]
[3056]Ymsgr_tray.exe-->user32.dll-->GetSysColor, Type: IAT modification 0x0040C2A4-->00000000 [yui.dll]
[3056]Ymsgr_tray.exe-->user32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x77D4133C-->00000000 [yui.dll]
[3056]Ymsgr_tray.exe-->user32.dll-->kernel32.dll-->LoadLibraryA, Type: IAT modification 0x77D412F8-->00000000 [yui.dll]
[3056]Ymsgr_tray.exe-->user32.dll-->kernel32.dll-->LoadLibraryExW, Type: IAT modification 0x77D41208-->00000000 [yui.dll]
[3056]Ymsgr_tray.exe-->user32.dll-->kernel32.dll-->LoadLibraryW, Type: IAT modification 0x77D41340-->00000000 [yui.dll]
[3056]Ymsgr_tray.exe-->user32.dll-->TrackPopupMenu, Type: IAT modification 0x0040C29C-->00000000 [yui.dll]
[3156]plugin-container.exe-->user32.dll-->TrackPopupMenu, Type: Inline - RelativeJump 0x77D94EDE-->00000000 [xul.dll]
[324]Sun Broadband Wireless.exe-->user32.dll-->EnableScrollBar, Type: Inline - RelativeJump 0x77D97BCD-->00000000 [SkinMagicU.dll]
[324]Sun Broadband Wireless.exe-->user32.dll-->EnableScrollBar, Type: Inline - SEH 0x77D97BD2 [unknown_code_page]
[324]Sun Broadband Wireless.exe-->user32.dll-->EnableScrollBar, Type: Inline - SEH 0x77D97BD3 [unknown_code_page]
[324]Sun Broadband Wireless.exe-->user32.dll-->GetScrollInfo, Type: Inline - RelativeJump 0x77D50E1A-->00000000 [SkinMagicU.dll]
[324]Sun Broadband Wireless.exe-->user32.dll-->GetScrollInfo, Type: Inline - SEH 0x77D50E1F [unknown_code_page]
[324]Sun Broadband Wireless.exe-->user32.dll-->GetScrollInfo, Type: Inline - SEH 0x77D50E20 [unknown_code_page]
[324]Sun Broadband Wireless.exe-->user32.dll-->GetScrollPos, Type: Inline - RelativeJump 0x77D5F6E4-->00000000 [SkinMagicU.dll]
[324]Sun Broadband Wireless.exe-->user32.dll-->GetScrollRange, Type: Inline - RelativeJump 0x77D5F767-->00000000 [SkinMagicU.dll]
[324]Sun Broadband Wireless.exe-->user32.dll-->GetSysColor, Type: Inline - RelativeJump 0x77D48E88-->00000000 [SkinMagicU.dll]
[324]Sun Broadband Wireless.exe-->user32.dll-->GetSysColorBrush, Type: Inline - RelativeJump 0x77D48EBB-->00000000 [SkinMagicU.dll]
[324]Sun Broadband Wireless.exe-->user32.dll-->SetScrollInfo, Type: Inline - RelativeJump 0x77D49066-->00000000 [SkinMagicU.dll]
[324]Sun Broadband Wireless.exe-->user32.dll-->SetScrollInfo, Type: Inline - SEH 0x77D4906B [unknown_code_page]
[324]Sun Broadband Wireless.exe-->user32.dll-->SetScrollInfo, Type: Inline - SEH 0x77D4906C [unknown_code_page]
[324]Sun Broadband Wireless.exe-->user32.dll-->SetScrollPos, Type: Inline - RelativeJump 0x77D5F730-->00000000 [SkinMagicU.dll]
[324]Sun Broadband Wireless.exe-->user32.dll-->SetScrollRange, Type: Inline - RelativeJump 0x77D5F97B-->00000000 [SkinMagicU.dll]
[324]Sun Broadband Wireless.exe-->user32.dll-->ShowScrollBar, Type: Inline - RelativeJump 0x77D5F2D5-->00000000 [SkinMagicU.dll]


!!POSSIBLE ROOTKIT ACTIVITY DETECTED!! =)

And another...

ESET Online Scan

Please run a free online scan with the ESET Online Scanner

• Tick the box next to YES, I accept the Terms of Use
  
• Click Start
  
• When asked, allow the ActiveX control to install
  
• Click Start
  
• Make sure that the options Remove found threats and the option Scan unwanted applications is checked
  
• Click Scan (This scan can take several hours, so please be patient)
  
• Once the scan is completed, you may close the window
  
• Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
  
• Copy and paste that log as a reply to this topic