I've had persistent browser redirect issues for weeks. TDSS killer is not finding an infection. The output of cheetah is:

Cheetah-Anti-Rogue v1.5.1
by DragonMaster Jay

Microsoft Windows XP [Version 5.1.2600]
Date: 16/10/2010 - Time: 10:15:59 - Arch.: x86


-- Malware removal tools check --
Malwarebytes' Anti-Malware


-- Known infection --

C:\WINDOWS\system32\dllcache\ndis.sys (HEUR:::Rtk.Agent)(!!The legit C:\WINDOWS\system32\drivers\ndis.sys may be infected!!)


Extra message: Detection only.


EOF

Any advice appreciated.

thanks

Hello, and welcome to The Ultimate Geek TaskForce!

Please note the following information about the malware forum:

• Only Trained Advisors, Moderators and Administrators are allowed to give advice on removing malware from your computer.
  
• From this point on, please do not make any more changes to your computer; such as install/uninstall programs, use special fix tools, delete files, edit the registry, etc. - unless advised by the staff I noted above.
  
• Please do not ask for help elsewhere (in this site or other sites). Doing so can result in system changes, which may not show up in the logs you post.
  
• If you have already asked for help somewhere, please post the link to the topic you were helped.
  
• We try our best to reply quickly, but for any reason we do not reply in two days, do this:
  
  Reply to this topic with the word BUMP.
  
  
• Lastly, keep in mind that we are volunteers, so you do not have to pay for malware removal. Persist in this topic until its close, and your computer is declared clean.

---

Please download 7-Zip and install it. If you already have it, no need to reinstall.

Then, download RootkitUnhooker and save the setup to your Desktop.

• Right-click on the RootkitUnhooker setup and mouse-over 7-Zip then click Extract to "RKU***"
  
• Once that is done, enter the folder, and double-click on the setup file. Navigate through setup and finish.
  
• Once that is done, you will see another folder that was created inside the RKU folder. Enter that folder, and double-click on the randomly named file. (It will be alpha-numeric and have an EXE extension on it.)
  
• It will initialize itself and load the scanner. It will also install its driver. Please wait for the interface to begin.
  
• Once inside the interface, do not fix anything. Click on the Report tab.
  
• Next, click on the Scan button and a popup will show. Make sure all are checked, then click on OK. It will begin scanning. When it gets to the Files tab, it will ask you what drives to scan. Just select C:\ and hit OK.
  
• It will finish in about 5 minutes or a little longer depending on how badly infected the system is, or if your security software is enabled.
  
• When finished, it will show the report in the Report tab. Please copy all of it, and post it in your next reply. Depending on how large the log is, you may have to use two or three posts to get all the information in.

RkU Version: 3.8.388.590, Type LE (SR2)
==============================================
OS Name: Windows XP
Version 5.1.2600 (Service Pack 3)
Number of processors #2
==============================================
>SSDT State
==============================================
ntkrnlpa.exe-->NtOpenProcess, Type: Address change 0x805CB3FA-->A9D4A6C0 [C:\WINDOWS\system32\DRIVERS\AVGIDSShim.Sys]
ntkrnlpa.exe-->NtTerminateProcess, Type: Address change 0x805D2982-->A9D4A770 [C:\WINDOWS\system32\DRIVERS\AVGIDSShim.Sys]
ntkrnlpa.exe-->NtTerminateThread, Type: Address change 0x805D2B7C-->A9D4A810 [C:\WINDOWS\system32\DRIVERS\AVGIDSShim.Sys]
ntkrnlpa.exe-->NtWriteVirtualMemory, Type: Address change 0x805B4378-->A9D4A8B0 [C:\WINDOWS\system32\DRIVERS\AVGIDSShim.Sys]
==============================================
>Shadow
==============================================
win32k.sys-->NtUserGetAsyncKeyState, Type: Address change 0xBF83C837-->A9D49C30 [C:\WINDOWS\system32\DRIVERS\AVGIDSShim.Sys]
win32k.sys-->NtUserGetKeyboardState, Type: Address change 0xBF8A0CE0-->A9D49B70 [C:\WINDOWS\system32\DRIVERS\AVGIDSShim.Sys]
win32k.sys-->NtUserGetKeyState, Type: Address change 0xBF81C764-->A9D49BC0 [C:\WINDOWS\system32\DRIVERS\AVGIDSShim.Sys]
win32k.sys-->NtUserSetWindowsHookEx, Type: Address change 0xBF8A0DA0-->A9D49AE0 [C:\WINDOWS\system32\DRIVERS\AVGIDSShim.Sys]
==============================================
>Processes
==============================================
0x865C47C0 [4] System
0x850FA508 [168] C:\WINDOWS\system32\igfxtray.exe (Intel Corporation, igfxTray Module)
0x84E22BE0 [212] C:\WINDOWS\system32\hkcmd.exe (Intel Corporation, hkcmd Module)
0x8619A6A0 [248] C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe (InterVideo, RegMgr Module)
0x858BD290 [328] C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe (Broadcom Corporation., Bluetooth Support Server)
0x858C43D0 [336] C:\Program Files\EeePC\ACPI\AsTray.exe (ASUSTeK Computer Inc., Eee PC Tray Utility)
0x8522B7A8 [340] C:\Program Files\AVG\AVG10\avgcsrvx.exe (AVG Technologies CZ, s.r.o., AVG Scanning Core Module - Server Part)
0x84FF7440 [344] C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe (Sun Microsystems, Inc., Java(TM) Platform SE binary)
0x84FB76A0 [368] C:\Program Files\Elantech\ETDCTRL.EXE (ELANTECH Devices Corp., ETD Ware TSR Enhancements)
0x8616D998 [420] C:\WINDOWS\system32\svchost.exe (Microsoft Corporation, Generic Host Process for Win32 Services)
0x861CBBF0 [436] C:\PROGRA~1\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o., AVG Resident Shield Service)
0x85094A48 [520] C:\Program Files\EeePC\ACPI\AsAcpiSvr.exe (ASUSTeK Computer Inc., Asus Eee PC ACPI Service)
0x84FFA6A8 [528] C:\Program Files\EeePC\ACPI\AsEPCMon.exe (ASUSTeK Computer Inc., AsEPCMon)
0x862A54D8 [712] C:\WINDOWS\system32\smss.exe (Microsoft Corporation, Windows NT Session Manager)
0x8621FC20 [744] C:\PROGRA~1\AVG\AVG10\avgchsvx.exe (AVG Technologies CZ, s.r.o., AVG Cache Server)
0x84C33020 [840] C:\Documents and Settings\jon\Desktop\MustBeRandomlyNamed\c8SfdM.exe (UG North, RKULE, SR2 Normandy)
0x8620A990 [916] C:\WINDOWS\system32\csrss.exe (Microsoft Corporation, Client Server Runtime Process)
0x861803B8 [948] C:\WINDOWS\system32\winlogon.exe (Microsoft Corporation, Windows NT Logon Application)
0x86211DA0 [996] C:\WINDOWS\system32\services.exe (Microsoft Corporation, Services and Controller app)
0x861EC408 [1008] C:\WINDOWS\system32\lsass.exe (Microsoft Corporation, LSA Shell (Export Version))
0x852304F8 [1180] C:\WINDOWS\system32\svchost.exe (Microsoft Corporation, Generic Host Process for Win32 Services)
0x85253DA0 [1228] C:\WINDOWS\system32\svchost.exe (Microsoft Corporation, Generic Host Process for Win32 Services)
0x861A8860 [1268] C:\WINDOWS\system32\svchost.exe (Microsoft Corporation, Generic Host Process for Win32 Services)
0x861706F0 [1312] C:\WINDOWS\system32\svchost.exe (Microsoft Corporation, Generic Host Process for Win32 Services)
0x84C81DA0 [1328] C:\WINDOWS\RTHDCPL.EXE (Realtek Semiconductor Corp., Realtek HD Audio Control Panel)
0x8619FBF0 [1380] C:\Documents and Settings\jon\Local Settings\Application Data\Google\Chrome\Application\chrome.exe (Google Inc., Google Chrome)
0x861A66A0 [1416] C:\WINDOWS\system32\svchost.exe (Microsoft Corporation, Generic Host Process for Win32 Services)
0x8523C780 [1580] C:\Documents and Settings\jon\Local Settings\Application Data\Google\Chrome\Application\chrome.exe (Google Inc., Google Chrome)
0x84FB55E8 [1612] C:\WINDOWS\system32\ctfmon.exe (Microsoft Corporation, CTF Loader)
0x8526C320 [1724] C:\WINDOWS\system32\spoolsv.exe (Microsoft Corporation, Spooler SubSystem App)
0x861B5DA0 [1808] C:\WINDOWS\system32\svchost.exe (Microsoft Corporation, Generic Host Process for Win32 Services)
0x85053860 [1988] C:\WINDOWS\system32\igfxext.exe (Intel Corporation, igfxext Module)
0x858BB660 [2032] C:\WINDOWS\system32\igfxsrvc.exe (Intel Corporation, igfxsrvc Module)
0x85F3B020 [2044] C:\WINDOWS\explorer.exe (Microsoft Corporation, Windows Explorer)
0x85071908 [2104] C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation., Bluetooth Tray Application)
0x84C777B0 [2112] C:\Program Files\ASUS\EeePC\Super Hybrid Engine\SuperHybridEngine.exe (ASUSTeK Computer Inc., Eee Super Hybrid Engine)
0x85236978 [2156] C:\Documents and Settings\jon\Local Settings\Application Data\Google\Chrome\Application\chrome.exe (Google Inc., Google Chrome)
0x84E1DBE0 [2252] C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe (Broadcom Corporation., Bluetooth Stack COM Server)
0x84F8A2A8 [2504] C:\Program Files\AVG\AVG10\avgnsx.exe (AVG Technologies CZ, s.r.o., AVG Online Shield Service)
0x85084320 [2520] C:\Program Files\AVG\AVG10\avgemcx.exe (AVG Technologies CZ, s.r.o., AVG E-mail Scanner)
0x84DF9DA0 [2764] C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe (AVG Technologies CZ, s.r.o., AVG IDS application)
0x850413D0 [3136] C:\Documents and Settings\jon\Local Settings\Application Data\Google\Chrome\Application\chrome.exe (Google Inc., Google Chrome)
0x85100020 [3440] C:\WINDOWS\system32\alg.exe (Microsoft Corporation, Application Layer Gateway Service)
0x851E32F8 [3708] C:\Documents and Settings\jon\Local Settings\Application Data\Google\Chrome\Application\chrome.exe (Google Inc., Google Chrome)
0x85254A48 [656] C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o., AVG IDS application)
0x850D9DA0 [1352] C:\Program Files\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o., AVG Tray Monitor)
0x8617DDA0 [1956] C:\Program Files\AVG\AVG10\avgwdsvc.exe (AVG Technologies CZ, s.r.o., AVG Watchdog Service)
==============================================
>Drivers
==============================================
0xF6D16000 C:\WINDOWS\system32\DRIVERS\igxpmp32.sys 5857280 bytes (Intel Corporation, Intel Graphics Miniport Driver)
0xAA2D4000 C:\WINDOWS\system32\drivers\RtkHDAud.sys 4984832 bytes (Realtek Semiconductor Corp., Realtek(r) High Definition Audio Function Driver)
0xBF1E7000 C:\WINDOWS\System32\igxpdx32.DLL 2699264 bytes (Intel Corporation, DirectDraw(R) Driver for Intel(R) Graphics Technology)
0x804D7000 C:\WINDOWS\system32\ntkrnlpa.exe 2150400 bytes (Microsoft Corporation, NT Kernel & System)
0x804D7000 PnpManager 2150400 bytes
0x804D7000 RAW 2150400 bytes
0x804D7000 WMIxWDM 2150400 bytes
0xBF800000 Win32k 1855488 bytes
0xBF800000 C:\WINDOWS\System32\win32k.sys 1855488 bytes (Microsoft Corporation, Multi-User Win32 Driver)
0xBF04F000 C:\WINDOWS\System32\igxpdv32.DLL 1671168 bytes (Intel Corporation, Component GHAL Driver)
0xF6B96000 C:\WINDOWS\system32\DRIVERS\athw.sys 1327104 bytes (Atheros Communications, Inc., Driver for Atheros AR5008 Wireless Network Adapter)
0xF6A81000 C:\WINDOWS\system32\DRIVERS\btkrnl.sys 987136 bytes (Broadcom Corporation., Bluetooth Bus Enumerator)
0xF733B000 Ntfs.sys 577536 bytes (Microsoft Corporation, NT File System Driver)
0xA9E80000 C:\WINDOWS\system32\drivers\btaudio.sys 528384 bytes (Broadcom Corporation., Bluetooth Audio Device)
0xA9FA1000 C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 458752 bytes (Microsoft Corporation, Windows NT SMB Minirdr)
0xF69B0000 C:\WINDOWS\system32\DRIVERS\update.sys 385024 bytes (Microsoft Corporation, Update Driver)
0xAA0F4000 C:\WINDOWS\system32\DRIVERS\tcpip.sys 364544 bytes (Microsoft Corporation, TCP/IP Protocol Driver)
0xA969E000 C:\WINDOWS\system32\DRIVERS\srv.sys 360448 bytes (Microsoft Corporation, Server driver)
0xAA0AC000 C:\WINDOWS\system32\DRIVERS\avgtdix.sys 294912 bytes (AVG Technologies CZ, s.r.o., AVG Network connection watcher)
0xBFFA0000 C:\WINDOWS\System32\ATMFD.DLL 286720 bytes (Adobe Systems Incorporated, Windows NT OpenType/Type 1 Font Driver)
0xA8E15000 C:\WINDOWS\System32\Drivers\HTTP.sys 266240 bytes (Microsoft Corporation, HTTP Protocol Stack)
0xA9F1F000 C:\WINDOWS\system32\DRIVERS\avgldx86.sys 245760 bytes (AVG Technologies CZ, s.r.o., AVG AVI Loader Driver)
0xF7459000 ACPI.sys 188416 bytes (Microsoft Corporation, ACPI Driver for NT)
0xA9A53000 C:\WINDOWS\system32\DRIVERS\mrxdav.sys 184320 bytes (Microsoft Corporation, Windows NT WebDav Minirdr)
0xF730E000 NDIS.sys 184320 bytes (Microsoft Corporation, NDIS 5.1 wrapper driver)
0xBF024000 C:\WINDOWS\System32\igxpgd32.dll 176128 bytes (Intel Corporation, Intel Graphics 2D Driver)
0xA8B42000 C:\WINDOWS\system32\drivers\kmixer.sys 176128 bytes (Microsoft Corporation, Kernel Mode Audio Mixer)
0xAA011000 C:\WINDOWS\system32\DRIVERS\rdbss.sys 176128 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver)
0xA95AE000 C:\WINDOWS\system32\DRIVERS\AVGIDSDriver.Sys 163840 bytes (AVG Technologies CZ, s.r.o. , IDS Application Activity Monitor Driver.)
0xF6CDA000 C:\WINDOWS\system32\DRIVERS\HDAudBus.sys 163840 bytes (Windows (R) Server 2003 DDK provider, High Definition Audio Bus Driver v1.0a)
0xAA05E000 C:\WINDOWS\system32\DRIVERS\netbt.sys 163840 bytes (Microsoft Corporation, MBT Transport driver)
0xAA086000 C:\WINDOWS\system32\DRIVERS\ipnat.sys 155648 bytes (Microsoft Corporation, IP Network Address Translator)
0xAA2B0000 C:\WINDOWS\system32\drivers\portcls.sys 147456 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices))
0xF6B72000 C:\WINDOWS\system32\DRIVERS\USBPORT.SYS 147456 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver)
0xF6A0E000 C:\WINDOWS\system32\DRIVERS\ks.sys 143360 bytes (Microsoft Corporation, Kernel CSA Library)
0xAA03C000 C:\WINDOWS\System32\drivers\afd.sys 139264 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock)
0x806E4000 ACPI_HAL 134400 bytes
0x806E4000 C:\WINDOWS\system32\hal.dll 134400 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL)
0xF73F1000 fltMgr.sys 131072 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager)
0xF7429000 ftdisk.sys 126976 bytes (Microsoft Corporation, FT Disk Driver)
0xA9F01000 C:\WINDOWS\system32\DRIVERS\btwdndis.sys 122880 bytes (Broadcom Corporation., Bluetooth LAN Access Server Driver)
0xA9F83000 C:\WINDOWS\System32\Drivers\usbvideo.sys 122880 bytes (Microsoft Corporation, USB Video Class Driver)
0xF72F4000 Mup.sys 106496 bytes (Microsoft Corporation, Multiple UNC Provider driver)
0xF7411000 atapi.sys 98304 bytes (Microsoft Corporation, IDE/ATAPI Port Driver)
0xA9DF0000 C:\WINDOWS\System32\Drivers\dump_atapi.sys 98304 bytes
0xF73C8000 KSecDD.sys 94208 bytes (Microsoft Corporation, Kernel Security Support Provider Interface)
0xF6A6A000 C:\WINDOWS\system32\DRIVERS\ndiswan.sys 94208 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption))
0xA9976000 C:\WINDOWS\system32\drivers\wdmaud.sys 86016 bytes (Microsoft Corporation, MMSYSTEM Wave/Midi API mapper)
0xF6D02000 C:\WINDOWS\system32\DRIVERS\VIDEOPRT.SYS 81920 bytes (Microsoft Corporation, Video Port Driver)
0xAA14D000 C:\WINDOWS\system32\DRIVERS\ipsec.sys 77824 bytes (Microsoft Corporation, IPSec Driver)
0xBF000000 C:\WINDOWS\System32\drivers\dxg.sys 73728 bytes (Microsoft Corporation, DirectX Graphics Driver)
0xBF012000 C:\WINDOWS\System32\igxprd32.dll 73728 bytes (Intel Corporation, Intel Graphics 2D Rotation Driver)
0xF73DF000 sr.sys 73728 bytes (Microsoft Corporation, System Restore Filesystem Filter Driver)
0xF7448000 pci.sys 69632 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator)
0xF6A31000 C:\WINDOWS\system32\DRIVERS\psched.sys 69632 bytes (Microsoft Corporation, MS QoS Packet Scheduler)
0xF7798000 C:\WINDOWS\system32\drivers\drmk.sys 61440 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter)
0xA9D28000 C:\WINDOWS\system32\drivers\sysaudio.sys 61440 bytes (Microsoft Corporation, System Audio WDM Filter)
0xF7788000 C:\WINDOWS\system32\DRIVERS\usbhub.sys 61440 bytes (Microsoft Corporation, Default Hub Driver for USB)
0xF76D8000 C:\WINDOWS\system32\DRIVERS\l1e51x86.sys 57344 bytes (Atheros Communications, Inc., Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller ndis miniport driver)
0xF7658000 C:\WINDOWS\system32\DRIVERS\btwhid.sys 53248 bytes (Broadcom Corporation., Bluetooth Virtual HID Minidriver)
0xF75C8000 C:\WINDOWS\system32\DRIVERS\CLASSPNP.SYS 53248 bytes (Microsoft Corporation, SCSI Class System Dll)
0xF76E8000 C:\WINDOWS\system32\DRIVERS\i8042prt.sys 53248 bytes (Microsoft Corporation, i8042 Port Driver)
0xF76F8000 C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 53248 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver)
0xF75A8000 VolSnap.sys 53248 bytes (Microsoft Corporation, Volume Shadow Copy Driver)
0xF77C8000 C:\WINDOWS\system32\DRIVERS\avgmfx86.sys 49152 bytes (AVG Technologies CZ, s.r.o., AVG Resident Shield Minifilter Driver)
0xF7718000 C:\WINDOWS\system32\DRIVERS\raspptp.sys 49152 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol)
0xF7648000 C:\WINDOWS\System32\Drivers\Fips.SYS 45056 bytes (Microsoft Corporation, FIPS Crypto Driver)
0xF7598000 MountMgr.sys 45056 bytes (Microsoft Corporation, Mount Manager)
0xF7708000 C:\WINDOWS\system32\DRIVERS\raspppoe.sys 45056 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver)
0xA99BB000 C:\WINDOWS\system32\DRIVERS\AVGIDSFilter.Sys 40960 bytes (AVG Technologies CZ, s.r.o. , IDS Application Activity Monitor Filter Driver.)
0xA9D48000 C:\WINDOWS\system32\DRIVERS\AVGIDSShim.Sys 40960 bytes (AVG Technologies CZ, s.r.o. , IDS Application Activity Monitor Loader Driver.)
0xF77D8000 C:\WINDOWS\System32\Drivers\btwusb.sys 40960 bytes (Broadcom Corporation., Driver for Bluetooth USB Devices)
0xF7588000 isapnp.sys 40960 bytes (Microsoft Corporation, PNP ISA Bus Driver)
0xF7748000 C:\WINDOWS\System32\Drivers\NDProxy.SYS 40960 bytes (Microsoft Corporation, NDIS Proxy)
0xF7738000 C:\WINDOWS\system32\DRIVERS\termdd.sys 40960 bytes (Microsoft Corporation, Terminal Server Driver)
0xF75D8000 AVGIDSEH.Sys 36864 bytes (AVG Technologies CZ, s.r.o. , IDS Application Activity Monitor Helper Driver.)
0xF75B8000 disk.sys 36864 bytes (Microsoft Corporation, PnP Disk Driver)
0xF7668000 C:\WINDOWS\system32\DRIVERS\HIDCLASS.SYS 36864 bytes (Microsoft Corporation, Hid Class Library)
0xF76C8000 C:\WINDOWS\system32\DRIVERS\intelppm.sys 36864 bytes (Microsoft Corporation, Processor Device Driver)
0xF7728000 C:\WINDOWS\system32\DRIVERS\msgpc.sys 36864 bytes (Microsoft Corporation, MS General Packet Classifier)
0xF7618000 C:\WINDOWS\system32\DRIVERS\netbios.sys 36864 bytes (Microsoft Corporation, NetBIOS interface driver)
0xA8CB5000 C:\WINDOWS\System32\Drivers\Normandy.SYS 36864 bytes (RKU Driver)
0xF7698000 C:\WINDOWS\system32\DRIVERS\wanarp.sys 36864 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver)
0xF78D8000 C:\WINDOWS\system32\DRIVERS\btport.sys 32768 bytes (Broadcom Corporation., Bluetooth BTPORT Driver for Windows 2000)
0xF7910000 C:\WINDOWS\System32\Drivers\Npfs.SYS 32768 bytes (Microsoft Corporation, NPFS Driver)
0xF7920000 C:\WINDOWS\system32\DRIVERS\usbccgp.sys 32768 bytes (Microsoft Corporation, USB Common Class Generic Parent Driver)
0xF78A0000 C:\WINDOWS\system32\DRIVERS\usbehci.sys 32768 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver)
0xF78B0000 C:\WINDOWS\system32\DRIVERS\ETD.sys 28672 bytes (ELANTECH Devices Corp., ETD Ware TSR Enhancements)
0xF78F8000 C:\WINDOWS\system32\DRIVERS\HIDPARSE.SYS 28672 bytes (Microsoft Corporation, Hid Parsing Library)
0xF7808000 C:\WINDOWS\system32\DRIVERS\PCIIDEX.SYS 28672 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension)
0xF78A8000 C:\WINDOWS\system32\DRIVERS\kbdclass.sys 24576 bytes (Microsoft Corporation, Keyboard Class Driver)
0xF78B8000 C:\WINDOWS\system32\DRIVERS\mouclass.sys 24576 bytes (Microsoft Corporation, Mouse Class Driver)
0xF7898000 C:\WINDOWS\system32\DRIVERS\usbuhci.sys 24576 bytes (Microsoft Corporation, UHCI USB Miniport Driver)
0xF7900000 C:\WINDOWS\System32\drivers\vga.sys 24576 bytes (Microsoft Corporation, VGA/Super VGA Video Driver)
0xF7818000 avgrkx86.sys 20480 bytes (AVG Technologies CZ, s.r.o., AVG Anti-Rootkit Driver)
0xF7908000 C:\WINDOWS\System32\Drivers\Msfs.SYS 20480 bytes (Microsoft Corporation, Mailslot driver)
0xF7810000 PartMgr.sys 20480 bytes (Microsoft Corporation, Partition Manager)
0xF78C8000 C:\WINDOWS\system32\DRIVERS\ptilink.sys 20480 bytes (Parallel Technologies, Inc., Parallel Technologies DirectParallel IO Library)
0xF78D0000 C:\WINDOWS\system32\DRIVERS\raspti.sys 20480 bytes (Microsoft Corporation, PTI DirectParallel(R) mini-port/call-manager driver)
0xF78C0000 C:\WINDOWS\system32\DRIVERS\TDI.SYS 20480 bytes (Microsoft Corporation, TDI Wrapper)
0xF7870000 C:\WINDOWS\System32\watchdog.sys 20480 bytes (Microsoft Corporation, Watchdog Driver)
0xF79A0000 C:\WINDOWS\system32\DRIVERS\BATTC.SYS 16384 bytes (Microsoft Corporation, Battery Class Driver)
0xF7A44000 C:\WINDOWS\system32\DRIVERS\CmBatt.sys 16384 bytes (Microsoft Corporation, Control Method Battery Driver)
0xF7A60000 C:\WINDOWS\system32\DRIVERS\mssmbios.sys 16384 bytes (Microsoft Corporation, System Management BIOS Driver)
0xA9CE4000 C:\WINDOWS\system32\DRIVERS\ndisuio.sys 16384 bytes (Microsoft Corporation, NDIS User mode I/O Driver)
0xF79A4000 ACPIEC.sys 12288 bytes (Microsoft Corporation, ACPI Embedded Controller Driver)
0xF7A48000 C:\WINDOWS\system32\DRIVERS\ASUSACPI.sys 12288 bytes (ASUSTeK Computer Inc., ASUS ACPI Device Driver)
0xF7998000 C:\WINDOWS\system32\BOOTVID.dll 12288 bytes (Microsoft Corporation, VGA Boot Driver)
0xF799C000 compbatt.sys 12288 bytes (Microsoft Corporation, Composite Battery Driver)
0xA9E68000 C:\WINDOWS\System32\drivers\Dxapi.sys 12288 bytes (Microsoft Corporation, DirectX API Driver)
0xF7A54000 C:\WINDOWS\system32\DRIVERS\ndistapi.sys 12288 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver)
0xF7A40000 C:\WINDOWS\system32\DRIVERS\rasacd.sys 12288 bytes (Microsoft Corporation, RAS Automatic Connection Driver)
0xF7A50000 C:\WINDOWS\system32\DRIVERS\wmiacpi.sys 12288 bytes (Microsoft Corporation, Windows Management Interface for ACPI)
0xF7AA8000 C:\WINDOWS\System32\Drivers\Beep.SYS 8192 bytes (Microsoft Corporation, BEEP Driver)
0xF7AF8000 C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS 8192 bytes
0xF7AA6000 C:\WINDOWS\System32\Drivers\Fs_Rec.SYS 8192 bytes (Microsoft Corporation, File System Recognizer Driver)
0xF7A88000 C:\WINDOWS\system32\KDCOM.DLL 8192 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL)
0xF7AAA000 C:\WINDOWS\System32\Drivers\mnmdd.SYS 8192 bytes (Microsoft Corporation, Frame buffer simulator)
0xF7AAC000 C:\WINDOWS\System32\DRIVERS\RDPCDD.sys 8192 bytes (Microsoft Corporation, RDP Miniport)
0xF7A94000 C:\WINDOWS\system32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator)
0xF7AA0000 C:\WINDOWS\system32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver)
0xF7A8A000 C:\WINDOWS\system32\DRIVERS\WMILIB.SYS 8192 bytes (Microsoft Corporation, WMILIB WMI support library Dll)
0xF7C83000 C:\WINDOWS\system32\DRIVERS\audstub.sys 4096 bytes (Microsoft Corporation, AudStub Driver)
0xF7C93000 C:\WINDOWS\System32\drivers\dxgthk.sys 4096 bytes (Microsoft Corporation, DirectX Graphics Driver Thunk)
0xF7C90000 C:\WINDOWS\System32\Drivers\Null.SYS 4096 bytes (Microsoft Corporation, NULL Driver)
0xF7B51000 C:\WINDOWS\system32\DRIVERS\OPRGHDLR.SYS 4096 bytes (Microsoft Corporation, ACPI Operation Registration Driver)
0xF7B50000 pciide.sys 4096 bytes (Microsoft Corporation, Generic PCI IDE Bus Driver)
==============================================
>Stealth
==============================================
==============================================
>Files
==============================================
==============================================
>Hooks
==============================================
ntkrnlpa.exe+0x0002D884, Type: Inline - RelativeJump 0x80504884-->80504831 [ntkrnlpa.exe]
ntkrnlpa.exe+0x0006ECBE, Type: Inline - RelativeJump 0x80545CBE-->80545CC5 [ntkrnlpa.exe]
[1580]chrome.exe-->kernel32.dll-->CreateNamedPipeW, Type: IAT modification 0x004631C0-->00000000 [unknown_code_page]
[1580]chrome.exe-->ntdll.dll-->NtOpenProcessToken, Type: Inline - RelativeCall 0x7C90D614-->00000000 [unknown_code_page]
[1580]chrome.exe-->ntdll.dll-->NtOpenThreadTokenEx, Type: Inline - RelativeCall 0x7C90D684-->00000000 [unknown_code_page]
[1580]chrome.exe-->ntdll.dll-->NtQueryFullAttributesFile, Type: Inline - RelativeCall 0x7C90D7B4-->00000000 [unknown_code_page]
[2044]explorer.exe-->advapi32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x77DD1218-->00000000 [shimeng.dll]
[2044]explorer.exe-->gdi32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x77F110B4-->00000000 [shimeng.dll]
[2044]explorer.exe-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x01001268-->00000000 [shimeng.dll]
[2044]explorer.exe-->shell32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x7C9C15A4-->00000000 [shimeng.dll]
[2044]explorer.exe-->user32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x7E41133C-->00000000 [shimeng.dll]
[2044]explorer.exe-->wininet.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x3D9314B0-->00000000 [shimeng.dll]
[2044]explorer.exe-->ws2_32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x71AB109C-->00000000 [shimeng.dll]
[3136]chrome.exe-->kernel32.dll-->CreateNamedPipeW, Type: IAT modification 0x004631C0-->00000000 [unknown_code_page]
[3136]chrome.exe-->ntdll.dll-->NtOpenProcessToken, Type: Inline - RelativeCall 0x7C90D614-->00000000 [unknown_code_page]
[3136]chrome.exe-->ntdll.dll-->NtOpenThreadTokenEx, Type: Inline - RelativeCall 0x7C90D684-->00000000 [unknown_code_page]
[3136]chrome.exe-->ntdll.dll-->NtQueryFullAttributesFile, Type: Inline - RelativeCall 0x7C90D7B4-->00000000 [unknown_code_page]


!!POSSIBLE ROOTKIT ACTIVITY DETECTED!! =)

Please download MBRCheck.exe by a_d_13 from one of the links provided below and save it to your desktop.

Link 1
Link 2
Link 3

• Double-click on MBRCheck.exe to run it.
  
• It will open a black window...please do not fix anything (if it gives you an option).
  
• When complete, you should see Done! Press ENTER to exit.... Press Enter on the keyboard.
  
• A log named MBRCheck_date_time.txt (i.e. MBRCheck_07.21.10_10.22.51.txt) will appear on the desktop.
  
• Please copy and paste the contents of that log in your next reply.

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Home Edition
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x0000000c

Kernel Drivers (total 121):
0x804D7000 \WINDOWS\system32\ntkrnlpa.exe
0x806E4000 \WINDOWS\system32\hal.dll
0xF7A88000 \WINDOWS\system32\KDCOM.DLL
0xF7998000 \WINDOWS\system32\BOOTVID.dll
0xF7459000 ACPI.sys
0xF7A8A000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xF7448000 pci.sys
0xF7588000 isapnp.sys
0xF799C000 compbatt.sys
0xF79A0000 \WINDOWS\system32\DRIVERS\BATTC.SYS
0xF7B50000 pciide.sys
0xF7808000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
0xF7598000 MountMgr.sys
0xF7429000 ftdisk.sys
0xF79A4000 ACPIEC.sys
0xF7B51000 \WINDOWS\system32\DRIVERS\OPRGHDLR.SYS
0xF7810000 PartMgr.sys
0xF75A8000 VolSnap.sys
0xF7411000 atapi.sys
0xF75B8000 disk.sys
0xF75C8000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xF73F1000 fltMgr.sys
0xF73DF000 sr.sys
0xF73C8000 KSecDD.sys
0xF733B000 Ntfs.sys
0xF730E000 NDIS.sys
0xF72F4000 Mup.sys
0xF7818000 avgrkx86.sys
0xF75D8000 AVGIDSEH.Sys
0xF76C8000 \SystemRoot\system32\DRIVERS\intelppm.sys
0xF6D16000 \SystemRoot\system32\DRIVERS\igxpmp32.sys
0xF6D02000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xF6CDA000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0xF76D8000 \SystemRoot\system32\DRIVERS\l1e51x86.sys
0xF6B96000 \SystemRoot\system32\DRIVERS\athw.sys
0xF7898000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0xF6B72000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xF78A0000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xF76E8000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0xF78A8000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xF78B0000 \SystemRoot\system32\DRIVERS\ETD.sys
0xF78B8000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xF7A40000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0xF7A44000 \SystemRoot\system32\DRIVERS\ASUSACPI.sys
0xF7A4C000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
0xF6A81000 \SystemRoot\system32\DRIVERS\btkrnl.sys
0xF7C80000 \SystemRoot\system32\DRIVERS\audstub.sys
0xF76F8000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xF7A50000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xF6A6A000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xF7708000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xF7718000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xF78C0000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xF6A31000 \SystemRoot\system32\DRIVERS\psched.sys
0xF7728000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xF78C8000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xF78D0000 \SystemRoot\system32\DRIVERS\raspti.sys
0xF7738000 \SystemRoot\system32\DRIVERS\termdd.sys
0xF7A92000 \SystemRoot\system32\DRIVERS\swenum.sys
0xF6A0E000 \SystemRoot\system32\DRIVERS\ks.sys
0xF69B0000 \SystemRoot\system32\DRIVERS\update.sys
0xF7A5C000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xF78D8000 \SystemRoot\system32\DRIVERS\btport.sys
0xF7748000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xF7788000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xF7A9E000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xAA2D4000 \SystemRoot\system32\drivers\RtkHDAud.sys
0xAA2B0000 \SystemRoot\system32\drivers\portcls.sys
0xF7798000 \SystemRoot\system32\drivers\drmk.sys
0xF77C8000 \SystemRoot\system32\DRIVERS\avgmfx86.sys
0xF77D8000 \SystemRoot\System32\Drivers\btwusb.sys
0xF7AA4000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xF7C8D000 \SystemRoot\System32\Drivers\Null.SYS
0xF7AA6000 \SystemRoot\System32\Drivers\Beep.SYS
0xF78F8000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0xF7900000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0xF7908000 \SystemRoot\System32\drivers\vga.sys
0xF7AA8000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xF7AAA000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xF7910000 \SystemRoot\System32\Drivers\Msfs.SYS
0xF7918000 \SystemRoot\System32\Drivers\Npfs.SYS
0xF7A3C000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xAA14D000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xAA0F4000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xAA0AC000 \SystemRoot\system32\DRIVERS\avgtdix.sys
0xAA086000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xAA068000 \SystemRoot\System32\Drivers\usbvideo.sys
0xAA040000 \SystemRoot\system32\DRIVERS\netbt.sys
0xAA01E000 \SystemRoot\System32\drivers\afd.sys
0xF7618000 \SystemRoot\system32\DRIVERS\netbios.sys
0xA9FF3000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xA9F5B000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xA9F3D000 \SystemRoot\system32\DRIVERS\btwdndis.sys
0xF7648000 \SystemRoot\System32\Drivers\Fips.SYS
0xA9EBC000 \SystemRoot\system32\drivers\btaudio.sys
0xF7658000 \SystemRoot\system32\DRIVERS\btwhid.sys
0xF7668000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0xA9E80000 \SystemRoot\system32\DRIVERS\avgldx86.sys
0xF76A8000 \SystemRoot\system32\DRIVERS\wanarp.sys
0xA9DF0000 \SystemRoot\System32\Drivers\dump_atapi.sys
0xF7AF8000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xA9E60000 \SystemRoot\System32\drivers\Dxapi.sys
0xF7870000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xF7C9C000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF024000 \SystemRoot\System32\igxpgd32.dll
0xBF012000 \SystemRoot\System32\igxprd32.dll
0xBF04F000 \SystemRoot\System32\igxpdv32.DLL
0xBF1E7000 \SystemRoot\System32\igxpdx32.DLL
0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
0xA9CD4000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xA99B3000 \SystemRoot\system32\DRIVERS\mrxdav.sys
0xA9B10000 \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys
0xA994E000 \SystemRoot\system32\drivers\wdmaud.sys
0xA9AE0000 \SystemRoot\system32\drivers\sysaudio.sys
0xA99E0000 \SystemRoot\system32\DRIVERS\AVGIDSFilter.Sys
0xA95D6000 \SystemRoot\system32\DRIVERS\srv.sys
0xA9586000 \SystemRoot\system32\DRIVERS\AVGIDSDriver.Sys
0xA8DED000 \SystemRoot\System32\Drivers\HTTP.sys
0x7C900000 \WINDOWS\system32\ntdll.dll

Processes (total 51):
0 System Idle Process
4 System
712 C:\WINDOWS\system32\smss.exe
744 C:\PROGRA~1\AVG\AVG10\avgchsvx.exe
916 csrss.exe
948 C:\WINDOWS\system32\winlogon.exe
996 C:\WINDOWS\system32\services.exe
1008 C:\WINDOWS\system32\lsass.exe
1184 C:\WINDOWS\system32\svchost.exe
1232 svchost.exe
1272 C:\WINDOWS\system32\svchost.exe
1448 svchost.exe
1492 svchost.exe
1752 C:\WINDOWS\system32\spoolsv.exe
1880 C:\WINDOWS\explorer.exe
1904 svchost.exe
1960 C:\Program Files\AVG\AVG10\avgwdsvc.exe
232 C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
340 C:\WINDOWS\system32\svchost.exe
624 C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
1672 C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
216 C:\WINDOWS\system32\igfxtray.exe
116 C:\WINDOWS\system32\hkcmd.exe
496 C:\Program Files\EeePC\ACPI\AsTray.exe
564 C:\Program Files\EeePC\ACPI\AsAcpiSvr.exe
1284 C:\Program Files\EeePC\ACPI\AsEPCMon.exe
1288 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
544 C:\Program Files\Elantech\ETDCTRL.EXE
428 C:\WINDOWS\system32\igfxsrvc.exe
1384 C:\WINDOWS\RTHDCPL.EXE
1388 C:\WINDOWS\system32\igfxext.exe
1824 C:\Program Files\AVG\AVG10\avgtray.exe
1972 C:\WINDOWS\system32\ctfmon.exe
2060 C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
2068 C:\Program Files\ASUS\EeePC\Super Hybrid Engine\SuperHybridEngine.exe
2164 C:\Program Files\AVG\AVG10\avgnsx.exe
2216 C:\Program Files\AVG\AVG10\avgemcx.exe
2276 C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe
3156 C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe
3384 alg.exe
1564 C:\Documents and Settings\jon\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
2360 C:\Documents and Settings\jon\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
1852 C:\WINDOWS\system32\msiexec.exe
3676 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
4012 wmiprvse.exe
1856 C:\PROGRA~1\AVG\AVG10\avgrsx.exe
3024 C:\Program Files\AVG\AVG10\avgcsrvx.exe
1460 C:\Documents and Settings\jon\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
2616 C:\Documents and Settings\jon\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
3464 C:\Documents and Settings\jon\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
3528 C:\Documents and Settings\jon\My Documents\Downloads\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000014`b4be7800 (NTFS)

PhysicalDrive0 Model Number: ST9160310AS, Rev: 0303

Size Device Name MBR Status
--------------------------------------------
149 GB \\.\PhysicalDrive0 Windows XP MBR code detected
SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A


Done!

Please visit this webpage for a tutorial on downloading and running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

See the area: Using ComboFix, and when done, post the log back here.

ComboFix 10-10-17.04 - jon 18/10/2010 20:32:36.1.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1015.525 [GMT 1:00]
Running from: c:\documents and settings\jon\My Documents\Downloads\ComboFix.exe
AV: AVG Anti-Virus Free Edition 2011 *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\Thumbs.db

.
((((((((((((((((((((((((( Files Created from 2010-09-18 to 2010-10-18 )))))))))))))))))))))))))))))))
.

2010-10-12 10:32 . 2008-04-13 23:09 14592 -c--a-w- c:\windows\system32\dllcache\kbdhid.sys
2010-10-12 10:32 . 2008-04-13 23:09 14592 ----a-w- c:\windows\system32\drivers\kbdhid.sys
2010-10-12 10:12 . 2010-10-12 10:12 -------- d-----w- c:\windows\system32\XPSViewer
2010-10-12 10:12 . 2010-10-12 10:12 -------- d-----w- c:\program files\MSBuild
2010-10-12 10:12 . 2010-10-12 10:12 -------- d-----w- c:\program files\Reference Assemblies
2010-10-12 10:11 . 2008-07-06 12:06 89088 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll
2010-10-12 10:11 . 2008-07-06 12:06 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2010-10-12 10:11 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll
2010-10-12 10:11 . 2008-07-06 10:50 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2010-10-12 10:11 . 2008-07-06 10:50 597504 ------w- c:\windows\system32\Spool\prtprocs\w32x86\printfilterpipelinesvc.exe
2010-10-12 10:11 . 2010-10-12 10:11 -------- d-----w- C:\c01370fb9b29e6ae10
2010-10-12 10:11 . 2008-07-06 12:06 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll
2010-10-12 10:11 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll
2010-10-12 10:11 . 2008-07-06 12:06 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll
2010-10-12 10:11 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll
2010-10-12 09:19 . 2010-02-12 10:03 293376 ------w- c:\windows\system32\browserchoice.exe
2010-10-12 09:11 . 2010-04-29 14:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-10-12 09:11 . 2010-10-12 09:11 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-10-12 09:11 . 2010-10-12 09:11 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-10-12 09:11 . 2010-04-29 14:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-10-12 09:08 . 2010-08-26 12:52 5120 ----a-w- c:\windows\system32\xpsp4res.dll
2010-10-12 05:30 . 2010-10-12 05:30 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2010-10-12 05:30 . 2010-10-12 05:30 -------- d--h--w- c:\documents and settings\All Users\Application Data\Common Files
2010-10-12 05:29 . 2010-10-18 19:23 -------- d-----w- c:\windows\system32\drivers\AVG
2010-10-12 05:29 . 2010-10-12 05:30 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG10
2010-10-12 05:28 . 2010-10-12 05:28 -------- d-----w- c:\program files\AVG
2010-10-12 05:22 . 2010-10-12 05:28 -------- d-----w- c:\documents and settings\All Users\Application Data\MFAData
2010-10-12 03:46 . 2010-10-12 05:08 -------- d-----w- c:\documents and settings\jon
2010-10-12 03:45 . 2009-01-08 08:41 -------- d-----w- c:\windows\system32\config\systemprofile\Bluetooth Software
2010-10-12 03:45 . 2009-01-08 08:41 -------- d-----w- c:\documents and settings\Default User\Bluetooth Software
2010-10-12 03:41 . 2008-04-14 04:06 8832 ----a-w- c:\windows\system32\drivers\wmiacpi.sys
2010-10-12 01:26 . 2010-10-12 01:29 -------- dc-h--w- c:\windows\ie8
2010-10-12 01:22 . 2010-08-26 11:08 13312 -c----w- c:\windows\system32\dllcache\iecompat.dll
2010-10-12 01:21 . 2010-09-10 05:58 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2010-10-12 01:21 . 2010-09-10 05:58 247808 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2010-10-12 01:21 . 2010-09-10 05:58 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll
2010-10-12 01:18 . 2010-10-12 01:18 -------- d-----w- c:\program files\SyncToy 2.1
2010-10-12 01:17 . 2010-10-12 01:17 -------- d-----w- c:\program files\Microsoft Sync Framework
2010-10-11 21:57 . 2009-08-06 18:23 274288 ----a-w- c:\windows\system32\mucltui.dll
2010-10-11 21:57 . 2009-08-06 18:23 215920 ----a-w- c:\windows\system32\muweb.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\jon\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2010-10-12 136176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-12-19 135168]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-12-19 159744]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-12-19 131072]
"AsusTray"="c:\program files\EeePC\ACPI\AsTray.exe" [2008-12-04 114688]
"AsusACPIServer"="c:\program files\EeePC\ACPI\AsAcpiSvr.exe" [2008-12-18 622592]
"AsusEPCMonitor"="c:\program files\EeePC\ACPI\AsEPCMon.exe" [2008-05-21 94208]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 132496]
"ETDWare"="c:\program files\Elantech\ETDCtrl.exe" [2008-11-24 329728]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2008-04-14 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2008-04-14 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 455168]
"RTHDCPL"="RTHDCPL.EXE" [2008-09-18 16855040]
"AVG_TRAY"="c:\program files\AVG\AVG10\avgtray.exe" [2010-09-15 2745696]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-9-2 604776]
SuperHybridEngine.lnk - c:\program files\ASUS\EeePC\Super Hybrid Engine\SuperHybridEngine.exe [2009-1-8 376832]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG10\avgchsvx.exe /sync\0c:\progra~1\AVG\AVG10\avgrsx.exe /sync /restart

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2007-10-11 00:51 39792 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
2008-06-19 08:20 57344 ----a-w- c:\windows\ALCMTR.EXE

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\AVG\\AVG10\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG10\\avgnsx.exe"=
"c:\\Program Files\\AVG\\AVG10\\avgmfapx.exe"=
"c:\\Program Files\\AVG\\AVG10\\avgemcx.exe"=

R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [13/09/2010 16:27 25680]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [07/09/2010 03:48 26064]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [07/09/2010 03:48 249424]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [07/09/2010 03:49 298448]
R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG10\avgwdsvc.exe [10/09/2010 01:45 265400]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [19/08/2010 21:42 123472]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [19/08/2010 21:42 30288]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [19/08/2010 21:42 26192]
S2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe [03/09/2010 10:35 6104144]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - HTTPFILTER
.
Contents of the 'Scheduled Tasks' folder

2010-10-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1890735561-2128801722-450647862-1006Core.job
- c:\documents and settings\jon\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-10-12 00:56]

2010-10-18 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1890735561-2128801722-450647862-1006UA.job
- c:\documents and settings\jon\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-10-12 00:56]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.co.uk/
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send To Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
.
- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-MsnMsgr - c:\program files\Windows Live\Messenger\MsnMsgr.Exe


.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(948)
c:\windows\system32\igfxdev.dll
.
Completion time: 2010-10-18 20:39:23
ComboFix-quarantined-files.txt 2010-10-18 19:39

Pre-Run: 68,358,471,680 bytes free
Post-Run: 68,490,280,960 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

- - End Of File - - E6873F5ED787ADA35977D9AB3690F7C4

Re-running ComboFix to remove infections:

• Close any open browsers.
  
• Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  
• Open notepad and copy/paste the text in the codebox below into it:
  

  killall::
  
  FileLook::
  c:\windows\system32\dllcache\kbdhid.sys
  c:\windows\system32\drivers\kbdhid.sys

• Save this as CFScript.txt, in the same location as ComboFix.exe
  
  
  
  
• Referring to the picture above, drag CFScript into ComboFix.exe
  
• When finished, it shall produce a log for you at C:\ComboFix.txt
  
• Please post the contents of the log in your next reply.

ComboFix 10-10-17.04 - jon 19/10/2010 7:40.2.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1015.513 [GMT 1:00]
Running from: C:\ComboFix.exe
Command switches used :: C:\CFScript.txt
AV: AVG Anti-Virus Free Edition 2011 *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2010-09-19 to 2010-10-19 )))))))))))))))))))))))))))))))
.

2010-10-12 10:32 . 2008-04-13 23:09 14592 -c--a-w- c:\windows\system32\dllcache\kbdhid.sys
2010-10-12 10:32 . 2008-04-13 23:09 14592 ----a-w- c:\windows\system32\drivers\kbdhid.sys
2010-10-12 10:12 . 2010-10-12 10:12 -------- d-----w- c:\windows\system32\XPSViewer
2010-10-12 10:12 . 2010-10-12 10:12 -------- d-----w- c:\program files\MSBuild
2010-10-12 10:12 . 2010-10-12 10:12 -------- d-----w- c:\program files\Reference Assemblies
2010-10-12 10:11 . 2008-07-06 12:06 89088 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll
2010-10-12 10:11 . 2008-07-06 12:06 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2010-10-12 10:11 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll
2010-10-12 10:11 . 2008-07-06 10:50 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2010-10-12 10:11 . 2008-07-06 10:50 597504 ------w- c:\windows\system32\Spool\prtprocs\w32x86\printfilterpipelinesvc.exe
2010-10-12 10:11 . 2010-10-12 10:11 -------- d-----w- C:\c01370fb9b29e6ae10
2010-10-12 10:11 . 2008-07-06 12:06 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll
2010-10-12 10:11 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll
2010-10-12 10:11 . 2008-07-06 12:06 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll
2010-10-12 10:11 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll
2010-10-12 09:19 . 2010-02-12 10:03 293376 ------w- c:\windows\system32\browserchoice.exe
2010-10-12 09:11 . 2010-04-29 14:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-10-12 09:11 . 2010-10-12 09:11 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-10-12 09:11 . 2010-10-12 09:11 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-10-12 09:11 . 2010-04-29 14:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-10-12 09:08 . 2010-08-26 12:52 5120 ----a-w- c:\windows\system32\xpsp4res.dll
2010-10-12 05:30 . 2010-10-12 05:30 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2010-10-12 05:30 . 2010-10-12 05:30 -------- d--h--w- c:\documents and settings\All Users\Application Data\Common Files
2010-10-12 05:29 . 2010-10-18 19:23 -------- d-----w- c:\windows\system32\drivers\AVG
2010-10-12 05:29 . 2010-10-12 05:30 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG10
2010-10-12 05:28 . 2010-10-12 05:28 -------- d-----w- c:\program files\AVG
2010-10-12 05:22 . 2010-10-12 05:28 -------- d-----w- c:\documents and settings\All Users\Application Data\MFAData
2010-10-12 03:46 . 2010-10-12 05:08 -------- d-----w- c:\documents and settings\jon
2010-10-12 03:45 . 2009-01-08 08:41 -------- d-----w- c:\windows\system32\config\systemprofile\Bluetooth Software
2010-10-12 03:45 . 2009-01-08 08:41 -------- d-----w- c:\documents and settings\Default User\Bluetooth Software
2010-10-12 03:41 . 2008-04-14 04:06 8832 ----a-w- c:\windows\system32\drivers\wmiacpi.sys
2010-10-12 01:26 . 2010-10-12 01:29 -------- dc-h--w- c:\windows\ie8
2010-10-12 01:22 . 2010-08-26 11:08 13312 -c----w- c:\windows\system32\dllcache\iecompat.dll
2010-10-12 01:21 . 2010-09-10 05:58 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2010-10-12 01:21 . 2010-09-10 05:58 247808 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2010-10-12 01:21 . 2010-09-10 05:58 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll
2010-10-12 01:18 . 2010-10-12 01:18 -------- d-----w- c:\program files\SyncToy 2.1
2010-10-12 01:17 . 2010-10-12 01:17 -------- d-----w- c:\program files\Microsoft Sync Framework
2010-10-11 21:57 . 2009-08-06 18:23 274288 ----a-w- c:\windows\system32\mucltui.dll
2010-10-11 21:57 . 2009-08-06 18:23 215920 ----a-w- c:\windows\system32\muweb.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

--- c:\windows\system32\dllcache\kbdhid.sys ---
Company: Microsoft Corporation
File Description: HID Mouse Filter Driver
File Version: 5.1.2600.5512 (xpsp.080413-2108)
Product Name: Microsoft® Windows® Operating System
Copyright: © Microsoft Corporation. All rights reserved.
Original Filename: kbdhid.sys
File size: 14592
Created time: 2010-10-12 10:32
Modified time: 2008-04-13 23:09
MD5: 9EF487A186DEA361AA06913A75B3FA99
SHA1: 916B14FDFB30A966EFDAF3A1F6D0F41A7CE5C308


--- c:\windows\system32\drivers\kbdhid.sys ---
Company: Microsoft Corporation
File Description: HID Mouse Filter Driver
File Version: 5.1.2600.5512 (xpsp.080413-2108)
Product Name: Microsoft® Windows® Operating System
Copyright: © Microsoft Corporation. All rights reserved.
Original Filename: kbdhid.sys
File size: 14592
Created time: 2010-10-12 10:32
Modified time: 2008-04-13 23:09
MD5: 9EF487A186DEA361AA06913A75B3FA99
SHA1: 916B14FDFB30A966EFDAF3A1F6D0F41A7CE5C308


((((((((((((((((((((((((((((( SnapShot@2010-10-18_19.37.17 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-01-09 05:31 . 2010-10-18 20:04 71462 c:\windows\system32\perfc009.dat
- 2009-01-09 05:31 . 2010-10-17 19:49 71462 c:\windows\system32\perfc009.dat
+ 2009-01-09 05:31 . 2010-10-18 20:04 441692 c:\windows\system32\perfh009.dat
- 2009-01-09 05:31 . 2010-10-17 19:49 441692 c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\jon\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2010-10-12 136176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-12-19 135168]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-12-19 159744]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-12-19 131072]
"AsusTray"="c:\program files\EeePC\ACPI\AsTray.exe" [2008-12-04 114688]
"AsusACPIServer"="c:\program files\EeePC\ACPI\AsAcpiSvr.exe" [2008-12-18 622592]
"AsusEPCMonitor"="c:\program files\EeePC\ACPI\AsEPCMon.exe" [2008-05-21 94208]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 132496]
"ETDWare"="c:\program files\Elantech\ETDCtrl.exe" [2008-11-24 329728]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2008-04-14 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2008-04-14 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 455168]
"RTHDCPL"="RTHDCPL.EXE" [2008-09-18 16855040]
"AVG_TRAY"="c:\program files\AVG\AVG10\avgtray.exe" [2010-09-15 2745696]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-9-2 604776]
SuperHybridEngine.lnk - c:\program files\ASUS\EeePC\Super Hybrid Engine\SuperHybridEngine.exe [2009-1-8 376832]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG10\avgchsvx.exe /sync\0c:\progra~1\AVG\AVG10\avgrsx.exe /sync /restart

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2007-10-11 00:51 39792 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
2008-06-19 08:20 57344 ----a-w- c:\windows\ALCMTR.EXE

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\AVG\\AVG10\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG10\\avgnsx.exe"=
"c:\\Program Files\\AVG\\AVG10\\avgmfapx.exe"=
"c:\\Program Files\\AVG\\AVG10\\avgemcx.exe"=

R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [13/09/2010 16:27 25680]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [07/09/2010 03:48 26064]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [07/09/2010 03:48 249424]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [07/09/2010 03:49 298448]
R2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe [03/09/2010 10:35 6104144]
R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG10\avgwdsvc.exe [10/09/2010 01:45 265400]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [19/08/2010 21:42 123472]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [19/08/2010 21:42 30288]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [19/08/2010 21:42 26192]
.
Contents of the 'Scheduled Tasks' folder

2010-10-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1890735561-2128801722-450647862-1006Core.job
- c:\documents and settings\jon\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-10-12 00:56]

2010-10-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1890735561-2128801722-450647862-1006UA.job
- c:\documents and settings\jon\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-10-12 00:56]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.co.uk/
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send To Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
.
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3380)
c:\windows\system32\WININET.dll
c:\windows\system32\btmmhook.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\btncopy.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\progra~1\AVG\AVG10\avgchsvx.exe
c:\progra~1\AVG\AVG10\avgrsx.exe
c:\program files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\program files\AVG\AVG10\avgnsx.exe
c:\program files\AVG\AVG10\avgemcx.exe
c:\windows\system32\igfxsrvc.exe
c:\windows\system32\igfxext.exe
c:\windows\RTHDCPL.EXE
c:\progra~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
c:\program files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2010-10-19 07:52:45 - machine was rebooted
ComboFix-quarantined-files.txt 2010-10-19 06:52
ComboFix2.txt 2010-10-18 19:39

Pre-Run: 68,446,416,896 bytes free
Post-Run: 68,428,914,688 bytes free

- - End Of File - - 20A6A1476C619AC590B22B7E41053017

Please download DrWeb-CureIt and save it to your Desktop. Do NOT perform a scan yet

• Double-click on drweb-cureit.exe to start the program.
  An Express Scan of your PC notice will appear.
  
• Under Start the Express Scan Now, Click OK to start the scan.
  This is a short scan that will scan the files currently running in memory.
  If something is found, click the Yes button when it asks you if you want to cure it.
  
• Once the short scan has finished, Click Options > Change settings
  
• Choose the Scan tab and UNcheck Heuristic analysis
  
• Back at the main window, click Custom Scan, then Select drives (a red dot will show which drives have been chosen).
  
• Then click the Start/Stop Scanning button (green arrow on the right, and the scan will start.
  
• When finished, a message will be displayed at the bottom advising if any viruses were found.
  
• Click Yes to all if it asks if you want to cure/move the file.
  
• When the scan has finished, look if you can see the icon next to the files found.
  If so, click it, then click the next icon right below and select Move incurable.
  (This will move it to the C:\Documents and Settings\userprofile\DoctorWeb\Quarantine folder if it can't be cured)
  
• Next, in the Dr.Web CureIt menu on top, click file and choose save report list.
  
• Save the DrWeb.csv report to your Desktop.
  
• Exit Dr.Web Cureit when you have finished.
  
• Important! Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.
  
• After reboot, post the contents of the log from Dr.Web in your next reply. (You can use Notepad to open the DrWeb.cvs report)
  

Cureit log attached.

cheers

Hi. It appears the log did not attach correctly. Try once more.

Hi

the log is 16 mg - and even zipped it's over 1 mg so it looks like it failed on file size. Are there parts of the file that I can extract and paste?

thanks

Will you tell me what the tool found..as in infection names?

Hi

Basically, it doesn't look like it found anything

Scan statistics
-----------------------------------------------------------------------------
Scanned: 156087
Infected: 0
Modifications: 0
Suspicious: 0
Adware: 0
Dialers: 0
Jokes: 0
Riskware: 0
Hacktools: 0
Cured: 0
Deleted: 0
Renamed: 0
Moved: 0
Ignored: 0
Scan speed: 364 Kb/s
Scan time: 2:52:23
-----------------------------------------------------------------------------

=============================================================================
Total session statistics
=============================================================================
Scanned: 169371
Infected: 0
Modifications: 0
Suspicious: 0
Adware: 0
Dialers: 0
Jokes: 0
Riskware: 0
Hacktools: 0
Cured: 0
Deleted: 0
Renamed: 0
Moved: 0
Ignored: 0
Scan speed: 199 Kb/s
Scan time: 3:24:48
=============================================================================

But I'm still getting browser redirects.