DCOM Service Launcher Terminated

[Frohike]

My wife's laptop has been getting this. I've done some research and seems most likely cause is malware/spyware and I can't seem to make it stop. I did download Adaware and Malwarebytes - they found a few things but it still happening.
Its windows 7 Home edition. Here is the HJT log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:41:09 AM, on 1/26/2010
Platform: Unknown Windows (WinNT 6.01.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
C:\Program Files\Camera Assistant Software for Gateway\traybar.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
C:\Program Files\IDT\WDM\sttray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Camera Assistant Software for Gateway\CEC_MAIN.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\PROGRA~1\Magentic\bin\MgApp.exe
C:\Program Files\SpeedFan\speedfan.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
C:\Program Files\IncrediMail\bin\IMApp.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\distnoted.exe
C:\Windows\system32\conhost.exe
C:\Program Files\Common Files\HP\Digital Imaging\Bin\hpqPhotoCrm.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\SyncServer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\conhost.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Internet explorer\Iexplore.exe
C:\Program Files\Internet explorer\Iexplore.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.gateway.com/g/startpage.html?Ch=Retail&SubCH=BB&Br=GTW&Loc=ENG_US&Sys=PTB&M=P-6831FX
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/sbcydsl/*http://www.yahoo.com/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mystart.incredimail.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.gateway.com/g/sidepanel.html?Ch=Retail&SubCH=BB&Br=GTW&Loc=ENG_US&Sys=PTB&M=P-6831FX
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
R3 - URLSearchHook: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\windows\system32\BAE.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [Camera Assistant Software] "C:\Program Files\Camera Assistant Software for Gateway\traybar.exe"
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
O4 - HKLM\..\Run: [McENUI] C:\PROGRA~1\McAfee\MHN\McENUI.exe /hide
O4 - HKLM\..\Run: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [EA Core] "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [Search Protection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
O4 - HKCU\..\Run: [Magentic] C:\PROGRA~1\Magentic\bin\Magentic.exe /c
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Startup: SpeedFan.lnk = C:\Program Files\SpeedFan\speedfan.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Event Reminder.lnk = C:\Program Files\PrintMaster 16\pmremind.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\Program Files\IncrediMail\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Show or hide HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O13 - Gopher Prefix:
O16 - DPF: {74C861A1-D548-4916-BC8A-FDE92EDFF62C} - http://mediaplayer.walmart.com/installer/install.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} -
O17 - HKLM\System\CCS\Services\Tcpip\..\{BD5A98A0-B009-4058-85D5-0F6819E0CB3A}: NameServer = 68.94.156.1,68.94.157.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{F6FDD5E5-BD62-4499-B57A-9DE8A721AE6B}: NameServer = 68.94.156.1,68.94.157.1
O18 - Protocol: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\Gateway Games\Gateway Game Console\GameConsoleService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee SiteAdvisor Service - McAfee, Inc. - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\Program Files\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\McProxy\McProxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\Mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\Windows\system32\PSIService.exe
O23 - Service: Audio Service (STacSV) - IDT, Inc. - C:\Windows\system32\STacSV.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

--
End of file - 13673 bytes

Please assist me!! I want to avoid reformat and reinstall of the OS.

Thanks.

[Derek]

are you getting search engine problems & diverts as well

try tdss killer from http://support.kaspersky.com/viruses/solutions?qid=208280684

post back with its log and we can go from there

[Frohike]

I have no search engine problems - but everyonce awhile I get a registry defender webpage come up - but it doesnt happen alot. Here is the log:
10:56:38:750 1804   TDSS rootkit removing tool 2.2.2 Jan 13 2010 08:42:25
10:56:38:750 1804   ================================================================================
10:56:38:750 1804   SystemInfo:

10:56:38:750 1804   OS Version: 6.1.7600 ServicePack: 0.0
10:56:38:750 1804   Product type: Workstation
10:56:38:750 1804   ComputerName: LISA-PC
10:56:38:752 1804   UserName: Lisa
10:56:38:752 1804   Windows directory: C:\Windows
10:56:38:752 1804   Processor architecture: Intel x86
10:56:38:752 1804   Number of processors: 2
10:56:38:752 1804   Page size: 0x1000
10:56:38:754 1804   Boot type: Normal boot
10:56:38:754 1804   ================================================================================
10:56:38:758 1804   UnloadDriverW: NtUnloadDriver error 2
10:56:38:758 1804   ForceUnloadDriverW: UnloadDriverW(klmd21) error 2
10:56:38:764 1804   MyNtCreateFileW: NtCreateFile(\??\C:\Windows\system32\drivers\klmd.sys) returned status 00000000
10:56:38:800 1804   UtilityInit: KLMD drop and load success
10:56:38:800 1804   KLMD_OpenDevice: Trying to open KLMD Device(KLMD201000)
10:56:38:800 1804   UtilityInit: KLMD open success
10:56:38:800 1804   UtilityInit: Initialize success
10:56:38:800 1804   
10:56:38:800 1804   Scanning   Services ...
10:56:38:802 1804   CreateRegParser: Registry parser init started
10:56:38:802 1804   CreateRegParser: DisableWow64Redirection error
10:56:38:802 1804   wfopen_ex: Trying to open file C:\Windows\system32\config\system
10:56:38:802 1804   MyNtCreateFileW: NtCreateFile(\??\C:\Windows\system32\config\system) returned status C0000043
10:56:38:802 1804   wfopen_ex: MyNtCreateFileW error 32 (C0000043)
10:56:38:802 1804   wfopen_ex: Trying to KLMD file open
10:56:38:802 1804   KLMD_CreateFileW: Trying to open file C:\Windows\system32\config\system
10:56:38:802 1804   wfopen_ex: File opened ok (Flags 2)
10:56:38:818 1804   CreateRegParser: HIVE_ADAPTER(C:\Windows\system32\config\system) init success: 17D2F48
10:56:38:818 1804   wfopen_ex: Trying to open file C:\Windows\system32\config\software
10:56:38:818 1804   MyNtCreateFileW: NtCreateFile(\??\C:\Windows\system32\config\software) returned status C0000043
10:56:38:818 1804   wfopen_ex: MyNtCreateFileW error 32 (C0000043)
10:56:38:818 1804   wfopen_ex: Trying to KLMD file open
10:56:38:818 1804   KLMD_CreateFileW: Trying to open file C:\Windows\system32\config\software
10:56:38:818 1804   wfopen_ex: File opened ok (Flags 2)
10:56:38:844 1804   CreateRegParser: HIVE_ADAPTER(C:\Windows\system32\config\software) init success: 17D2F70
10:56:38:844 1804   CreateRegParser: EnableWow64Redirection error
10:56:38:844 1804   CreateRegParser: RegParser init completed
10:56:39:514 1804   GetAdvancedServicesInfo: Raw services enum returned 474 services
10:56:39:520 1804   fclose_ex: Trying to close file C:\Windows\system32\config\system
10:56:39:520 1804   fclose_ex: Trying to close file C:\Windows\system32\config\software
10:56:39:522 1804   
10:56:39:522 1804   Scanning   Kernel memory ...
10:56:39:523 1804   KLMD_GetSystemObjectAddressByNameW: Trying to get system object address by name \Driver\Disk
10:56:39:523 1804   DetectCureTDL3: \Driver\Disk PDRIVER_OBJECT: 87248F38
10:56:39:523 1804   DetectCureTDL3: KLMD_GetDeviceObjectList returned 1 DevObjects
10:56:39:523 1804   
10:56:39:523 1804   DetectCureTDL3: DEVICE_OBJECT: 8724D030
10:56:39:523 1804   KLMD_GetLowerDeviceObject: Trying to get lower device object for 8724D030
10:56:39:523 1804   DetectCureTDL3: DEVICE_OBJECT: 860D8938
10:56:39:523 1804   KLMD_GetLowerDeviceObject: Trying to get lower device object for 860D8938
10:56:39:523 1804   DetectCureTDL3: DEVICE_OBJECT: 86080028
10:56:39:523 1804   KLMD_GetLowerDeviceObject: Trying to get lower device object for 86080028
10:56:39:523 1804   KLMD_ReadMem: Trying to ReadMemory 0x86080028[0x38]
10:56:39:523 1804   DetectCureTDL3: DRIVER_OBJECT: 860E3B18
10:56:39:523 1804   KLMD_ReadMem: Trying to ReadMemory 0x860E3B18[0xA8]
10:56:39:523 1804   KLMD_ReadMem: Trying to ReadMemory 0x860CD030[0x38]
10:56:39:523 1804   KLMD_ReadMem: Trying to ReadMemory 0x860CC368[0xA8]
10:56:39:523 1804   KLMD_ReadMem: Trying to ReadMemory 0x860A94D8[0x1C]
10:56:39:523 1804   DetectCureTDL3: DRIVER_OBJECT name: \Driver\iaStor, Driver Name: iaStor
10:56:39:523 1804   DetectCureTDL3: IrpHandler (0) addr: 864BC856
10:56:39:523 1804   DetectCureTDL3: IrpHandler (1) addr: 864BC856
10:56:39:523 1804   DetectCureTDL3: IrpHandler (2) addr: 864BC856
10:56:39:523 1804   DetectCureTDL3: IrpHandler (3) addr: 864BC856
10:56:39:523 1804   DetectCureTDL3: IrpHandler (4) addr: 864BC856
10:56:39:523 1804   DetectCureTDL3: IrpHandler (5) addr: 864BC856
10:56:39:523 1804   DetectCureTDL3: IrpHandler (6) addr: 864BC856
10:56:39:523 1804   DetectCureTDL3: IrpHandler (7) addr: 864BC856
10:56:39:523 1804   DetectCureTDL3: IrpHandler ( addr: 864BC856
10:56:39:523 1804   DetectCureTDL3: IrpHandler (9) addr: 864BC856
10:56:39:523 1804   DetectCureTDL3: IrpHandler (10) addr: 864BC856
10:56:39:523 1804   DetectCureTDL3: IrpHandler (11) addr: 864BC856
10:56:39:523 1804   DetectCureTDL3: IrpHandler (12) addr: 864BC856
10:56:39:523 1804   DetectCureTDL3: IrpHandler (13) addr: 864BC856
10:56:39:523 1804   DetectCureTDL3: IrpHandler (14) addr: 864BC856
10:56:39:523 1804   DetectCureTDL3: IrpHandler (15) addr: 864BC856
10:56:39:524 1804   DetectCureTDL3: IrpHandler (16) addr: 864BC856
10:56:39:524 1804   DetectCureTDL3: IrpHandler (17) addr: 864BC856
10:56:39:524 1804   DetectCureTDL3: IrpHandler (18) addr: 864BC856
10:56:39:524 1804   DetectCureTDL3: IrpHandler (19) addr: 864BC856
10:56:39:524 1804   DetectCureTDL3: IrpHandler (20) addr: 864BC856
10:56:39:524 1804   DetectCureTDL3: IrpHandler (21) addr: 864BC856
10:56:39:524 1804   DetectCureTDL3: IrpHandler (22) addr: 864BC856
10:56:39:524 1804   DetectCureTDL3: IrpHandler (23) addr: 864BC856
10:56:39:524 1804   DetectCureTDL3: IrpHandler (24) addr: 864BC856
10:56:39:524 1804   DetectCureTDL3: IrpHandler (25) addr: 864BC856
10:56:39:524 1804   DetectCureTDL3: IrpHandler (26) addr: 864BC856
10:56:39:524 1804   DetectCureTDL3: All IRP handlers pointed to one addr: 864BC856
10:56:39:524 1804   KLMD_ReadMem: Trying to ReadMemory 0x864BC856[0x400]
10:56:39:524 1804   TDL3_IrpHookDetect: CheckParameters: 4, FFDF0308, 333, 121, 3, 109
10:56:39:524 1804   Driver "iaStor" Irp handler infected by TDSS rootkit ... 10:56:39:524 1804   KLMD_WriteMem: Trying to WriteMemory 0x864BC8CF[0xD]
10:56:39:524 1804   cured
10:56:39:525 1804   KLMD_ReadMem: Trying to ReadMemory 0x864BC701[0x400]
10:56:39:525 1804   TDL3_StartIoHookDetect: CheckParameters: 9, FFDF0308, 1
10:56:39:525 1804   Driver "iaStor" StartIo handler infected by TDSS rootkit ... 10:56:39:525 1804   TDL3_StartIoHookCure: Number of patches 1
10:56:39:525 1804   KLMD_WriteMem: Trying to WriteMemory 0x864BC80A[0x6]
10:56:39:525 1804   cured
10:56:39:527 1804   TDL3_FileDetect: Processing driver: iaStor
10:56:39:527 1804   TDL3_FileDetect: Processing driver file: C:\Windows\system32\DRIVERS\iaStor.sys
10:56:39:527 1804   KLMD_CreateFileW: Trying to open file C:\Windows\system32\DRIVERS\iaStor.sys
10:56:39:559 1804   TDL3_FileDetect: C:\Windows\system32\DRIVERS\iaStor.sys - Verdict: Infected
10:56:39:559 1804   File C:\Windows\system32\DRIVERS\iaStor.sys infected by TDSS rootkit ... 10:56:39:560 1804   TDL3_FileCure: Processing driver file: C:\Windows\system32\DRIVERS\iaStor.sys
10:56:39:882 1804   FileCallback: Backup candidate found: C:\Windows\system32\DriverStore\FileRepository\iaahci.inf_x86_neutral_e0c941a8b0e04b56\iaStor.sys:329752, checking..
10:56:39:903 1804   ValidateDriverFile: Stage 1 passed
10:56:39:905 1804   ValidateDriverFile: Stage 2 passed
10:56:39:980 1804   DigitalSignVerifyByHandle: Embedded DS result: 00000000
10:56:39:980 1804   ValidateDriverFile: Stage 3 passed
10:56:39:980 1804   FileCallback: File validated successfully, restore information prepared
10:56:41:492 1804   FindDriverFileBackup: Backup copy found in DriverStore
10:56:41:493 1804   TDL3_FileCure: Backup copy found, using it..
10:56:41:493 1804   TDL3_FileCure: Dumping cured buffer to file C:\Windows\system32\drivers\tskC25D.tmp
10:56:41:530 1804   TDL3_FileCure: New / Old Image paths: (system32\drivers\tskC25D.tmp, system32\drivers\iaStor.sys)
10:56:41:532 1804   TDL3_FileCure: KLMD jobs schedule success
10:56:41:532 1804   will be cured on next reboot
10:56:41:532 1804   UtilityBootReinit: Reboot required for cure complete..
10:56:41:533 1804   MyNtCreateFileW: NtCreateFile(\??\C:\Windows\system32\drivers\klmdb.sys) returned status 00000000
10:56:41:537 1804   UtilityBootReinit: KLMD drop success
10:56:41:537 1804   KLMD_ApplyPendList: Pending buffer(3392_742, 616) dropped successfully
10:56:41:537 1804   UtilityBootReinit: Cure on reboot scheduled successfully
10:56:41:537 1804   
10:56:41:538 1804   Completed
10:56:41:538 1804   
10:56:41:539 1804   Results:
10:56:41:539 1804   Memory objects infected / cured / cured on reboot:   2 / 2 / 0
10:56:41:539 1804   Registry objects infected / cured / cured on reboot:   0 / 0 / 0
10:56:41:540 1804   File objects infected / cured / cured on reboot:   1 / 0 / 1
10:56:41:540 1804   
10:56:41:542 1804   UnloadDriverW: NtUnloadDriver error 1
10:56:41:542 1804   KLMD_Unload: UnloadDriverW(klmd21) error 1
10:56:41:543 1804   MyNtCreateFileW: NtCreateFile(\??\C:\Windows\system32\drivers\klmd.sys) returned status 00000000
10:56:41:543 1804   UtilityDeinit: KLMD(ARK) unloaded successfully

[Derek]

reboot then

Delete any existing version of ComboFix you have sitting on your desktop

Please read and follow all these instructions very carefully

Download ComboFix from Here to your Desktop.

**Note:  It is important that it is saved directly to your desktop  and run from the desktop and not any other folder on your computer**
--------------------------------------------------------------------
1. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

• Very Important! Temporarily disable your anti-virus and  anti-malware real-time protection and any script blocking components of them or your firewall before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results" or stop combofix running at all
• Click on THIS LINK to see instructions on how to temporarily disable many security programs while running combofix. The list does not cover every program. If yours is not listed and you don't know how to disable it, please ask.
  
• Remember to re enable the protection again after combofix has finished
  

--------------------------------------------------------------------
2. Close any open browsers and any other programs you might have running

Double click on combofix.exe & follow the prompts.

If you are using windows XP It might display a pop up saying that "Recovery console is not installed, do you want to install?"
Please select yes & let it download the files it needs to do this
When finished, it will produce a report for you. 
Please post the "C:\ComboFix.txt" for further review


****Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze ****

Note: ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.
Note: Combofix prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell us when you reply. Read HERE why we disable autoruns

Please do not install any new programs or update anything (always allow your antivirus/antispyware to update) unless told to do so while we are fixing your problem. If combofix alerts to a new version and offers to update, please let it. It is essential we always use the latest version. 


Download ComboFix   BETA

[Frohike]

Ok - here is the Combofix log:
Few things - when it was running I kept getting Find String QGREP Utility has stopped working box - alot, but kept scanning - eventually rebooted and while it was preparing a log I got a BSOD - so I rebooted but it did not come up again - so no log file, so I ran it again.

This time it scanned with no boxes popping up and rebooted and the log file prepared this time. Here ya go:
ComboFix 10-01-26.02 - Lisa 01/26/2010  14:29:29.2.2 - x86
Microsoft Windows 7 Home Premium   6.1.7600.0.1252.1.1033.18.3070.2135 [GMT -6:00]
Running from: c:\users\Lisa\Downloads\ComboFix.exe
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\Lisa\AppData\Local\Temp\sfamcc00001.dll
c:\users\Lisa\AppData\Local\Temp\sfareca00001.dll
.
---- Previous Run -------
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
C:\s
c:\users\Lisa\AppData\Local\Temp\sfamcc00001.dll
c:\users\Lisa\AppData\Local\Temp\sfareca00001.dll
c:\windows\COUPON~1.OCX
c:\windows\CouponPrinter.ocx
D:\Autorun.inf

-- Previous Run --

c:\windows\system32\wuauclt.exe . . . is infected!!

--------

.
(((((((((((((((((((((((((   Files Created from 2009-12-26 to 2010-01-26  )))))))))))))))))))))))))))))))
.

2010-01-26 20:39 . 2010-01-26 20:39   --------   d-----w-   c:\users\Jeremy\AppData\Local\temp
2010-01-26 20:39 . 2010-01-26 20:39   --------   d-----w-   c:\users\Guest\AppData\Local\temp
2010-01-26 20:39 . 2010-01-26 20:39   --------   d-----w-   c:\users\Default\AppData\Local\temp
2010-01-26 17:15 . 2010-01-14 17:12   181120   ------w-   c:\windows\system32\MpSigStub.exe
2010-01-26 10:23 . 2010-01-19 13:13   162640   ----a-w-   c:\windows\system32\drivers\aswSP.sys
2010-01-26 10:23 . 2010-01-19 11:46   46544   ----a-w-   c:\windows\system32\drivers\aswTdi.sys
2010-01-26 10:23 . 2010-01-19 11:43   23248   ----a-w-   c:\windows\system32\drivers\aswRdr.sys
2010-01-26 10:23 . 2010-01-19 11:42   19024   ----a-w-   c:\windows\system32\drivers\aswFsBlk.sys
2010-01-26 10:23 . 2010-01-19 11:43   51792   ----a-w-   c:\windows\system32\drivers\aswMonFlt.sys
2010-01-26 10:23 . 2010-01-19 11:57   38848   ----a-w-   c:\windows\system32\avastSS.scr
2010-01-26 10:23 . 2010-01-19 11:57   152672   ----a-w-   c:\windows\system32\aswBoot.exe
2010-01-26 10:23 . 2010-01-26 10:23   --------   d-----w-   c:\programdata\Alwil Software
2010-01-26 10:23 . 2010-01-26 10:23   --------   d-----w-   c:\program files\Alwil Software
2010-01-26 09:57 . 2010-01-26 09:57   --------   d-----w-   c:\users\Lisa\AppData\Roaming\HPAppData
2010-01-25 22:20 . 2010-01-25 22:20   --------   d-----w-   c:\program files\Trend Micro
2010-01-24 02:42 . 2010-01-24 02:42   --------   d-----w-   c:\users\Lisa\AppData\Roaming\Malwarebytes
2010-01-24 02:42 . 2010-01-24 02:42   --------   d-----w-   c:\programdata\Malwarebytes
2010-01-24 02:42 . 2010-01-24 22:31   --------   d-----w-   c:\program files\Malwarebytes' Anti-Malware
2010-01-22 22:24 . 2010-01-24 22:31   --------   dc----w-   c:\programdata\{BC9FCCF7-E686-494B-8C9B-55C9A39A7CA9}
2010-01-22 22:23 . 2010-01-22 22:23   --------   d-----w-   c:\program files\Lavasoft
2010-01-22 22:23 . 2010-01-22 22:25   --------   d-----w-   c:\programdata\Lavasoft
2010-01-18 08:31 . 2010-01-18 08:31   --------   d-----w-   c:\programdata\NCH Software
2010-01-13 00:48 . 2010-01-13 00:48   --------   d-----w-   c:\program files\Babylon
2009-12-31 14:02 . 2009-12-31 14:02   --------   d-----w-   c:\users\Lisa\AppData\Local\ElevatedDiagnostics
2009-12-30 05:01 . 2009-12-30 05:01   --------   d-----w-   c:\users\Lisa\AppData\Roaming\Atari
2009-12-29 09:48 . 2010-01-24 22:31   --------   d-----w-   c:\program files\Steam

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-26 20:41 . 2008-02-18 02:41   --------   d-----w-   c:\program files\SpeedFan
2010-01-26 16:58 . 2009-06-03 13:41   329752   ----a-w-   c:\windows\system32\drivers\iaStor.sys
2010-01-26 10:16 . 2008-11-17 21:31   --------   d-----w-   c:\programdata\McAfee
2010-01-26 09:42 . 2009-11-23 20:07   --------   d-----w-   c:\program files\Microsoft Silverlight
2010-01-25 22:39 . 2009-06-12 16:45   --------   d-----w-   c:\programdata\Yahoo! Companion
2010-01-25 22:39 . 2008-05-25 15:48   --------   d-----w-   c:\program files\NCH Swift Sound
2010-01-25 22:39 . 2008-02-18 06:12   --------   d-----w-   c:\programdata\HP
2010-01-25 22:39 . 2009-02-06 19:32   --------   d-----w-   c:\program files\Electronic Arts
2010-01-25 22:38 . 2008-05-25 15:48   --------   d-----w-   c:\program files\NCH Software
2010-01-25 00:52 . 2009-02-28 20:29   --------   d-----w-   c:\programdata\Electronic Arts
2010-01-18 08:31 . 2008-05-25 15:49   --------   d-----w-   c:\programdata\NCH Swift Sound
2009-12-17 05:52 . 2009-10-29 18:18   127325   ----a-w-   c:\users\Lisa\AppData\Roaming\Move Networks\uninstall.exe
2009-12-17 05:52 . 2009-08-13 19:21   4187512   ----a-w-   c:\users\Lisa\AppData\Roaming\Move Networks\plugins\npqmp071505000011.dll
2009-12-17 05:52 . 2009-04-06 20:52   --------   d-----w-   c:\users\Lisa\AppData\Roaming\Move Networks
2009-12-09 09:00 . 2007-12-14 09:31   --------   d-----w-   c:\programdata\Microsoft Help
2009-12-06 22:16 . 2009-12-06 22:16   0   ---ha-w-   c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2009-12-06 03:37 . 2009-12-06 03:37   --------   d-----w-   c:\programdata\PhotoMail
2009-12-06 03:37 . 2009-12-06 03:37   --------   d-----w-   c:\program files\PhotoMail Maker
2009-12-04 20:00 . 2009-01-28 06:31   --------   d-----w-   c:\users\Lisa\AppData\Roaming\Corel
2009-12-04 20:00 . 2009-01-28 06:31   848   --sha-w-   c:\windows\system32\KGyGaAvL.sys
2009-12-04 07:35 . 2009-11-20 03:35   120488   ----a-w-   c:\users\Lisa\AppData\Local\GDIPFONTCACHEV1.DAT
2009-12-04 07:34 . 2008-02-18 06:21   --------   d-----w-   c:\users\Lisa\AppData\Roaming\HP
2009-12-04 07:34 . 2009-01-30 01:02   199036   ----a-w-   c:\windows\hpoins31.dat
2009-12-04 07:27 . 2008-02-18 06:17   --------   d-----w-   c:\program files\HP
2009-12-04 07:02 . 2009-12-04 07:00   --------   d-----w-   c:\program files\Windows Live
2009-12-04 07:01 . 2009-12-04 07:01   --------   d-----w-   c:\program files\Microsoft SQL Server Compact Edition
2009-12-04 07:00 . 2009-12-04 07:00   --------   d-----w-   c:\program files\Microsoft
2009-12-04 07:00 . 2009-12-04 07:00   --------   d-----w-   c:\program files\Windows Live SkyDrive
2009-12-04 06:55 . 2009-12-04 06:55   --------   d-----w-   c:\program files\Common Files\Windows Live
2009-11-20 03:48 . 2009-11-20 03:47   23124   ----a-w-   c:\windows\hpqins15.dat
2009-11-20 03:46 . 2009-11-20 03:46   56   ---ha-w-   c:\programdata\ezsidmv.dat
2009-11-20 03:40 . 2009-11-20 03:40   92   ----a-w-   c:\users\Lisa\AppData\Local\fusioncache.dat
2009-11-20 02:52 . 2009-11-20 02:52   21924   ----a-w-   c:\windows\system32\emptyregdb.dat
2009-11-20 00:33 . 2007-12-14 08:57   1539   ----a-w-   c:\windows\bthservsdp.dat
2009-11-12 23:07 . 2009-11-12 23:07   79144   ----a-w-   c:\programdata\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe
2009-10-29 18:18 . 2009-06-16 06:35   4183416   ----a-w-   c:\users\Lisa\AppData\Roaming\Move Networks\plugins\npqmp071503000010.dll
2009-10-29 07:22 . 2009-11-25 09:02   2048   ----a-w-   c:\windows\system32\tzres.dll
2009-06-10 21:26 . 2009-07-14 02:04   9633792   --sha-r-   c:\windows\Fonts\StaticCache.dat
2009-07-14 01:14 . 2009-07-13 23:42   396800   --sha-w-   c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504]
"EA Core"="c:\program files\Electronic Arts\EADM\Core.exe" [2009-09-03 3342336]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2009-07-14 144384]
"IncrediMail"="c:\program files\IncrediMail\bin\IncMail.exe" [2009-01-27 251264]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-05-27 4351216]
"Search Protection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2009-02-23 111856]
"Magentic"="c:\progra~1\Magentic\bin\Magentic.exe" [2008-08-04 488808]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-02-15 857648]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440]
"Camera Assistant Software"="c:\program files\Camera Assistant Software for Gateway\traybar.exe" [2007-09-13 638976]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-02-11 186904]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-05-01 13781536]
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2009-02-23 111856]
"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2007-11-10 409600]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-11 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-12 141600]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-07-23 150528]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-01-19 2743104]

c:\users\Lisa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2008-10-25 98696]
SpeedFan.lnk - c:\program files\SpeedFan\speedfan.exe [2008-11-21 3835904]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Event Reminder.lnk - c:\program files\PrintMaster 16\pmremind.exe [2004-1-20 339968]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-9-20 270336]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^BigFix.lnk]
backup=c:\windows\pss\BigFix.lnk.CommonStartup
backupExtension=.CommonStartup
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\BigFix.lnk

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ]
2008-09-01 15:08   173304   ----a-w-   c:\program files\ICQ6\ICQ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2009-07-26 22:44   3883856   ----a-w-   c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2009-10-09 19:11   25623336   ----a-r-   c:\program files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spare Backup]
2007-09-14 00:22   5252936   ----a-w-   c:\program files\Spare Backup\SpareBackup.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
2009-07-14 01:14   660480   ----a-w-   c:\program files\Windows Defender\MSASCui.exe

R0 Si3531;SiI-3531 SATA Controller;c:\windows\System32\drivers\Si3531.sys [2/5/2009 6:38 PM 212520]
R1 aswSP;aswSP;c:\windows\System32\drivers\aswSP.sys [1/26/2010 4:23 AM 162640]
R2 aswFsBlk;aswFsBlk;c:\windows\System32\drivers\aswFsBlk.sys [1/26/2010 4:23 AM 19024]
R2 aswMonFlt;aswMonFlt;c:\windows\System32\drivers\aswMonFlt.sys [1/26/2010 4:23 AM 51792]
R3 KMWDFILTERx86;HIDServiceDesc;c:\windows\System32\drivers\KMWDFILTER.sys [4/29/2009 3:37 PM 25088]
R3 netw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\System32\drivers\netw5v32.sys [6/10/2009 3:18 PM 4231168]
R3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\System32\drivers\WSDPrint.sys [7/13/2009 6:18 PM 17920]

--- Other Services/Drivers In Memory ---

*Deregistered* - mfeavfk
*Deregistered* - mfebopk
*Deregistered* - mferkdk
*Deregistered* - mfesmfk
*Deregistered* - MPFP

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt   REG_MULTI_SZ      hpqcxs08 hpqddsvc
HPZ12   REG_MULTI_SZ      Pml Driver HPZ12 Net Driver HPZ12
HPService   REG_MULTI_SZ      HPSLPSVC
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://mystart.incredimail.com/
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
mStart Page = hxxp://www.yahoo.com/
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
IE: &Add animation to IncrediMail Style Box - c:\program files\IncrediMail\bin\resources\WebMenuImg.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
TCP: {BD5A98A0-B009-4058-85D5-0F6819E0CB3A} = 68.94.156.1,68.94.157.1
TCP: 2375942554839353 = 68.94.156.1,68.94.157.1
TCP: {F6FDD5E5-BD62-4499-B57A-9DE8A721AE6B} = 68.94.156.1,68.94.157.1
FF - ProfilePath - c:\users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\mpgn396r.default\
FF - prefs.js: browser.search.selectedEngine - MyStart Search
FF - prefs.js: browser.startup.homepage - hxxp://mystart.incredimail.com/
FF - prefs.js: keyword.URL - hxxp://mystart.incredimail.com/?loc=ff_address_bar_PMM_std_alone&search=
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpClipBook.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpClipBookDB.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpNeoLogger.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpSaturn.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpSmartSelect.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpSmartWebPrinting.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpSWPOperation.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpXPLogging.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpXPMTC.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpXPMTL.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpXREStub.dll
FF - plugin: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\plugins\nphpclipbook.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npCouponPrinter.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmusicn.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: c:\users\Lisa\AppData\Roaming\Move Networks\plugins\npqmp071503000010.dll
FF - plugin: c:\users\Lisa\AppData\Roaming\Move Networks\plugins\npqmp071505000011.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-HP Software Update - c:\program files\HP\HP Software Update\HPWuSchd2.exe
SafeBoot-mcmscsvc
SafeBoot-MCODS
MSConfigStartUp-HP Software Update - c:\program files\HP\HP Software Update\HPWuSchd2.exe
MSConfigStartUp-My Web Search Bar Search Scope Monitor - c:\progra~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe
MSConfigStartUp-MyWebSearch Email Plugin - c:\progra~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
MSConfigStartUp-MyWebSearch Plugin - c:\progra~1\MYWEBS~1\bar\1.bin\M3PLUGIN.DLL
MSConfigStartUp-NapsterShell - c:\program files\Napster\napster.exe
AddRemove-WinAce Archiver - c:\program files\WinAce\SXUNINST.EXE


.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'Explorer.exe'(5896)
c:\windows\system32\btncopy.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\windows\system32\nvvsvc.exe
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
c:\windows\system32\PSIService.exe
c:\windows\system32\STacSV.exe
c:\windows\system32\taskhost.exe
c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
c:\windows\system32\conhost.exe
c:\program files\Alwil Software\Avast5\AvastUI.exe
c:\program files\Camera Assistant Software for Gateway\CEC_MAIN.exe
c:\progra~1\Magentic\bin\MgApp.exe
c:\program files\IncrediMail\bin\IMApp.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\distnoted.exe
c:\windows\system32\conhost.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\SyncServer.exe
c:\windows\system32\conhost.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\sppsvc.exe
c:\program files\IncrediMail\bin\ImNotfy.exe
.
**************************************************************************
.
Completion time: 2010-01-26  14:48:00 - machine was rebooted
ComboFix-quarantined-files.txt  2010-01-26 20:47

Pre-Run: 125,342,035,968 bytes free
Post-Run: 125,260,312,576 bytes free

- - End Of File - - F181669491AD6F30A16DD781AD5F6DC2

[Derek]

please run malwarebytes again & post its latest log

I think Combofix cleared up things but want to make sure 

[Frohike]

Alright - I got it. I have a question - that TDSS rootkit - would you happen to know the most common distribution for it? Email, website , etc??? Just trying to figure out how it got on.

Here is the log:
Malwarebytes' Anti-Malware 1.44
Database version: 3642
Windows 6.1.7600
Internet Explorer 8.0.7600.16385

1/26/2010 4:45:22 PM
mbam-log-2010-01-26 (16-45-22).txt

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 340167
Time elapsed: 1 hour(s), 5 minute(s), 32 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 14
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\Interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{741de825-a6f0-4497-9aa6-8023cf9b0fff} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{cf54be1c-9359-4395-8533-1657cf209cfe} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{d518921a-4a03-425e-9873-b9a71756821e} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{9ff05104-b030-46fc-94b8-81276e4e27df} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59c7fc09-1c83-4648-b3e6-003d2bbc7481} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68af847f-6e91-45dd-9b68-d6a12c30e5d7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170b96c-28d4-4626-8358-27e6caeef907} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{d1a71fa0-ff48-48dd-9b6d-7a13a3e42127} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ddb1968e-ead6-40fd-8dae-ff14757f60c7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{f138d901-86f0-4383-99b6-9cdd406036da} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Users\Lisa\Downloads\MyFunCardsSetup2.3.50.45.ZUfox000.exe (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Users\Lisa\Downloads\ZwinkySetup2.3.50.26.ZJfox000.exe (Adware.MyWebSearch) -> Quarantined and deleted successfully.

[Derek]

tdl3 seems to be via websites & P2P downloads

until very recently, it was mainly P2P but now it seems to be infected adverts or fake downloads on seemingly legitimate sites or vulnerabilities in out of date software like Java or adobe reader etc


*Follow these steps to uninstall Combofix and the other tools it downloaded to remove the malware*
*  Click START then RUN
*  Now type Combofix /Uninstall in the runbox  and click OK.  Note the space between the X and the /U, it needs to be there.


This will also purge the restore folder and clear any malware that has been put in there. Now Empty Recycle bin on desktop Then reboot.

go here http://www.thespykiller.co.uk/index.php?page=3 for info on how to tighten your security settings and how to help prevent future attacks.

and scan here http://secunia.com/software_inspector/ for out of date & vulnerable common applications on your computer and update whatever it suggests

Then pay an urgent visit to windows update & make sure you are fully updated,  that will help to plug the security holes that let these pests on in the first place

[Would you do all this for nothing?]

You have come to The Spykiller for help because your Antivirus or Antispyware hasn't been able to fix your problem.

Modern Malware has become so involved and difficult to fix that it takes a very long time and a lot of hard work to read all the logs posted here and research and prepare the fixes for you. In many cases each part of the fix takes about 30 minutes to prepare, so a large part of my time is spent helping you

Would you do all this for nothing?

The reason I run this site is to raise funds for Hedgehog Rescue

Please donate if I have helped you or you have found this site useful.

You can donate safely and securely by using the paypal service, just click on one of the buttons below.

To donate in UK £

To donate in US$

To donate in Euro €

Any amount no matter how small is gratefully accepted and needed to ensure we keep the Rescue Centre running

To donate via paypal when the button doesn't appear or the link doesn't work: just go to www.paypal.com or your country's paypal log in page and chose send money and use help@thehedgehog.co.uk as recipient email address and select other service as the option. then follow prompts

[Information]

  
  Information
   Security & Protection Blog
   Prevention
   Using Autoruns
     System Restore
  Rss feeds
     Microsoft at Home
     MSRC
     Malware blog

Take the Kaspersky Challenge: See what your current antivirus is missing. Our free online virus scanner is a great way to find out if you have any viruses or spyware on your machine without having to uninstall your current antivirus software or install a new one.

Kaspersky Online Scanner

Most importantly, you can see what viruses your current antivirus software let slip through! Now works with ANY Java enabled browser