Hey all,

My young un has infected the pc. He was playing games on Facebook,( I thought they'd be quite safe?!,but they can't be..this is the 2nd or 3rd time now he's bugged us : (

Anyway, it's the 'Personal Internet Security' virus, the one which looks like a very 'proper' program. I'm guessing he clicked on it and BAM, we're infected, alsorts popping up, so I had to disconnect from the 'net.

Had a heck of a job this time getting rid, and it's still infected. Even going on D-A-L, after cleaning, loads of random USA, $$$ sites etc keep popping up...

So far I've had to run it in safe mode:
Spybot - 123 problems,102 of them trojans..wouldn't let me clean it - access denied,win 32 or summat!

Malwarebytes (mbam), 790 bugs, deleted,quarantined,emptied the virus vault, reeboot,re scan, same again!

Can't seem to run spybot or mbam as an administrator, which I am..(thought you just right click the icon? It's not letting me..)

Searched files for Personal Internet Security, 4 files found, all 2kb shortcuts. I deleted these and the desktop icon vanished : )

Hijack this, had a few items listed which looked dodgy. I'm no expert so I went carefully, and just removed a few obvious ones..$$$$ USA stuff etc,as all ours is UK..
oh, and 04 - Personal Internet Security was on there, so I deleted it : )

Rescanned again, Spybot, CLEAN,
Mbam, CLEAN,
AVG Free, CLEAN

But it isn't : (

Hijack still shows up loads of google pages, starting with 01 etc, I reckon these need wiping?

Like I said, even on first hook up to the internet, onto DAL, I'm haveng to try shut random $$$ pages / USA billing stuff etc really fast, or I then have to unhook from the 'net again..

Help please

Here's a hijack log I've just done, sorry if it's not right, I tried to find the instructions on posting a log but the pop ups went crazy...

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 13:11:59, on 24/01/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Virgin Broadband Wireless\AffinegyService.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Kontiki\KService.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\WinPcap\rpcapd.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Virgin Broadband Wireless\Wireless Manager.exe
C:\Program Files\Entriq\MediaSphere\EntriqMediaTray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Entriq\MediaSphere\3.8.2.9\EntriqMediaServer .exe
C:\Program Files\Virgin Broadband Wireless\ndis_events.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trusteer\Rapport\bin\RapportService.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Trend Micro\HijackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Searchy UK Metacrawler: Search 15 top UK Search Engines
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Hotmail, Messenger, Free Online News, Sport, Music, Movies, Money and Cars from MSN UK
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Hotmail, Messenger, Free Online News, Sport, Music, Movies, Money and Cars from MSN UK
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = *.local
O1 - Hosts: 69.10.57.34 Google
O1 - Hosts: 69.10.57.34 google.com
O1 - Hosts: 69.10.57.34 google.com.au
O1 - Hosts: 69.10.57.34 Google
O1 - Hosts: 69.10.57.34 google.be
O1 - Hosts: 69.10.57.34 Google
O1 - Hosts: 69.10.57.34 google.com.br
O1 - Hosts: 69.10.57.34 Google
O1 - Hosts: 69.10.57.34 google.ca
O1 - Hosts: 69.10.57.34 Google
O1 - Hosts: 69.10.57.34 google.ch
O1 - Hosts: 69.10.57.34 Google
O1 - Hosts: 69.10.57.34 google.de
O1 - Hosts: 69.10.57.34 Google
O1 - Hosts: 69.10.57.34 google.dk
O1 - Hosts: 69.10.57.34 Google
O1 - Hosts: 69.10.57.34 google.fr
O1 - Hosts: 69.10.57.34 Google
O1 - Hosts: 69.10.57.34 google.ie
O1 - Hosts: 69.10.57.34 Google
O1 - Hosts: 69.10.57.34 google.it
O1 - Hosts: 69.10.57.34 Google
O1 - Hosts: 69.10.57.34 google.co.jp
O1 - Hosts: 69.10.57.34 Google
O1 - Hosts: 69.10.57.34 google.nl
O1 - Hosts: 69.10.57.34 Google
O1 - Hosts: 69.10.57.34 google.no
O1 - Hosts: 69.10.57.34 Google
O1 - Hosts: 69.10.57.34 google.co.nz
O1 - Hosts: 69.10.57.34 Google
O1 - Hosts: 69.10.57.34 google.pl
O1 - Hosts: 69.10.57.34 Google
O1 - Hosts: 69.10.57.34 google.se
O1 - Hosts: 69.10.57.34 Google
O1 - Hosts: 69.10.57.34 google.co.uk
O1 - Hosts: 69.10.57.34 Google
O1 - Hosts: 69.10.57.34 google.co.za
O1 - Hosts: 69.10.57.34 Google
O1 - Hosts: 69.10.57.34 Google Analytics | Official Website
O1 - Hosts: 69.10.57.34 Bing
O1 - Hosts: 69.10.57.34 search.yahoo.com
O1 - Hosts: 69.10.57.34 Yahoo! Search - Web Search
O1 - Hosts: 69.10.57.34 uk.search.yahoo.com
O1 - Hosts: 69.10.57.34 ca.search.yahoo.com
O1 - Hosts: 69.10.57.34 de.search.yahoo.com
O1 - Hosts: 69.10.57.34 fr.search.yahoo.com
O1 - Hosts: 69.10.57.34 au.search.yahoo.com
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Wireless Manager] "C:\Program Files\Virgin Broadband Wireless\Wireless Manager.exe" startup
O4 - HKLM\..\Run: [five Media Manager Tray] "C:\Program Files\Entriq\MediaSphere\EntriqMediaTray.exe" /CustomId:five
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\RunOnce: [Shockwave Updater] C:\WINDOWS\system32\Adobe\Shockwave 11\SwHelper_1150596.exe -Update -1150596 -"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" -"http://www.freeonlinegames.com/game/dawn-of-the-dead.html"
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Documents and Settings\D\Application Data\DVDVideoSoftIEHelpers\youtubetomp3.htm
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6 FF0C6D236BF8.dll/cmsidewiki.html
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Go to PlaySushi web site - {EBD24BD3-E272-4FA3-A8BA-C5D709757CAB} - C:\Program Files\PlaySushi\PSText.dll (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/...oUploader5.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1234968617747
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1268926494218
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/...Uploader55.cab
O16 - DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/acti..._v1-0-27-0.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {FD0EBBED-0C42-4D0F-82DA-44399B5C420A} (VM_1.VM_Control) - http://downloads.virginmedia.com/CST/ver1/xp_mail.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: AffinegyService - Affinegy, Inc. - C:\Program Files\Virgin Broadband Wireless\AffinegyService.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Ati External Event Utility - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe (file missing)
O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: KService - Unknown owner - C:\Program Files\Kontiki\KService.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Rapport Management Service (RapportMgmtService) - Trusteer Ltd. - C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe

--
End of file - 10040 bytes

Thankyou very muchly in advance, Dave : )

Please, read HERE and post required logs.

Please, observe following rules:

• Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
• If you're stuck, or you're not sure about certain step, always ask before doing anything else.
• Please refrain from running tools or applying updates other than those I suggest.
• Never run more than one scan at a time.
• Keep updating me regarding your computer behavior, good, or bad.
• The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
• If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
• I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

Cheers Broni : )

Logs as requested:

Malwarebytes' Anti-Malware 1.46
Malwarebytes

Database version: 5594

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

25/01/2011 13:03:06
mbam-log-2011-01-25 (13-03-06).txt

Scan type: Quick scan
Objects scanned: 156219
Time elapsed: 3 minute(s), 55 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

GMER 1.0.15.15530 - GMER - Rootkit Detector and Remover
Rootkit scan 2011-01-25 13:46:48
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\00000068 WDC_WD3200AAJS-00L7A0 rev.01.03E01
Running: GMER.exe; Driver: C:\DOCUME~1\D\LOCALS~1\Temp\pxdoypod.sys


---- System - GMER 1.0.15 ----

SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwAssignProcessToJobObject [0xB370CFE4]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwCreateFile [0xB370D996]
SSDT Lbd.sys (Boot Driver/Lavasoft AB) ZwCreateKey [0xB80F887E]
SSDT \??\C:\Documents and Settings\All Users\Application Data\Trusteer\Rapport\store\exts\RapportCerberus\1 9917\RapportCerberus_19917.sys (RapportCerberus/Trusteer Ltd.) ZwCreateThread [0xB83CB864]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwDeleteFile [0xB370DAF6]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwDeleteKey [0xB371136C]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwDeleteValueKey [0xB371139E]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwLoadKey [0xB3711500]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwOpenFile [0xB370DA5A]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwOpenProcess [0xB370D128]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwOpenThread [0xB370D31A]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwProtectVirtualMemory [0xB370D44C]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwQueryValueKey [0xB3711476]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwRenameKey [0xB37113E0]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwReplaceKey [0xB3711412]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwRestoreKey [0xB3711444]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwSetContextThread [0xB370CF8A]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwSetInformationFile [0xB370DB56]
SSDT \??\C:\Documents and Settings\All Users\Application Data\Trusteer\Rapport\store\exts\RapportCerberus\1 9917\RapportCerberus_19917.sys (RapportCerberus/Trusteer Ltd.) ZwSetValueKey [0xB83CB82E]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwSuspendThread [0xB370CF26]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwTerminateProcess [0xB370CE7A]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwTerminateThread [0xB370CEC2]

---- Kernel code sections - GMER 1.0.15 ----

.text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xB71E4380, 0x550AF5, 0xE8000020]

---- User code sections - GMER 1.0.15 ----

.text C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[1032] ntdll.dll!KiUserApcDispatcher 7C90E450 5 Bytes JMP 00414C10 C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe (RapportMgmtService/Trusteer Ltd.)
.text C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[1032] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 716B0022
.text C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[1032] USER32.dll!GetGUIThreadInfo + FB 7E428023 6 Bytes JMP 716E001E
.text C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[1032] WS2_32.dll!getaddrinfo 71AB2A6F 5 Bytes JMP 71650022
.text C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[1032] WS2_32.dll!gethostbyname 71AB5355 5 Bytes JMP 71680022
.text C:\Program Files\Trusteer\Rapport\bin\RapportService.exe[2960] ntdll.dll!KiUserApcDispatcher 7C90E450 5 Bytes JMP 004397C0 C:\Program Files\Trusteer\Rapport\bin\RapportService.exe (RapportService/Trusteer Ltd.)
.text C:\Program Files\Trusteer\Rapport\bin\RapportService.exe[2960] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 716B0022
.text C:\Program Files\Trusteer\Rapport\bin\RapportService.exe[2960] WS2_32.dll!getaddrinfo 71AB2A6F 5 Bytes JMP 71680022
.text C:\Program Files\Trusteer\Rapport\bin\RapportService.exe[2960] WS2_32.dll!gethostbyname 71AB5355 5 Bytes JMP 716E0022

---- Devices - GMER 1.0.15 ----

AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Tcp Lbd.sys (Boot Driver/Lavasoft AB)
AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Udp Lbd.sys (Boot Driver/Lavasoft AB)
AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\RawIp Lbd.sys (Boot Driver/Lavasoft AB)

---- EOF - GMER 1.0.15 ----

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Professional
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x0000000c

Kernel Drivers (total 123):
0x804D7000 \WINDOWS\system32\ntkrnlpa.exe
0x806E4000 \WINDOWS\system32\hal.dll
0xB85A8000 \WINDOWS\system32\KDCOM.DLL
0xB84B8000 \WINDOWS\system32\BOOTVID.dll
0xB7F79000 ACPI.sys
0xB85AA000 \WINDOWS\System32\DRIVERS\WMILIB.SYS
0xB7F68000 pci.sys
0xB80A8000 isapnp.sys
0xB8670000 pciide.sys
0xB8328000 \WINDOWS\System32\DRIVERS\PCIIDEX.SYS
0xB80B8000 MountMgr.sys
0xB7F49000 ftdisk.sys
0xB85AC000 dmload.sys
0xB7F23000 dmio.sys
0xB8330000 PartMgr.sys
0xB80C8000 VolSnap.sys
0xB7F0B000 atapi.sys
0xB7EE7000 nvgts.sys
0xB7ECF000 \WINDOWS\system32\DRIVERS\SCSIPORT.SYS
0xB7EB5000 nvata.sys
0xB80D8000 disk.sys
0xB80E8000 \WINDOWS\System32\DRIVERS\CLASSPNP.SYS
0xB7E95000 fltmgr.sys
0xB7E83000 sr.sys
0xB80F8000 Lbd.sys
0xB7E6C000 KSecDD.sys
0xB7DDF000 Ntfs.sys
0xB7DB2000 NDIS.sys
0xB8108000 RapportKELL.sys
0xB85AE000 \WINDOWS\System32\Drivers\USBD.SYS
0xB7D98000 Mup.sys
0xB8138000 \SystemRoot\system32\DRIVERS\AmdK8.sys
0xB8148000 \SystemRoot\System32\DRIVERS\serial.sys
0xB8568000 \SystemRoot\System32\DRIVERS\serenum.sys
0xB7D3C000 \SystemRoot\System32\DRIVERS\parport.sys
0xB8158000 \SystemRoot\System32\DRIVERS\i8042prt.sys
0xB84A0000 \SystemRoot\System32\DRIVERS\kbdclass.sys
0xB84A8000 \SystemRoot\System32\DRIVERS\mouclass.sys
0xB84B0000 \SystemRoot\System32\DRIVERS\usbohci.sys
0xB7D18000 \SystemRoot\System32\DRIVERS\USBPORT.SYS
0xB8340000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xB7CF0000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0xB8168000 \SystemRoot\system32\DRIVERS\imapi.sys
0xB8178000 \SystemRoot\System32\DRIVERS\cdrom.sys
0xB8188000 \SystemRoot\System32\DRIVERS\redbook.sys
0xB7CCD000 \SystemRoot\System32\DRIVERS\ks.sys
0xB8360000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
0xB8198000 \SystemRoot\system32\DRIVERS\nvnetbus.sys
0xB7BB1000 \SystemRoot\system32\DRIVERS\NVNRM.SYS
0xB71E4000 \SystemRoot\system32\DRIVERS\nv4_mini.sys
0xB71D0000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xB868B000 \SystemRoot\System32\DRIVERS\audstub.sys
0xB81A8000 \SystemRoot\System32\DRIVERS\rasl2tp.sys
0xB8570000 \SystemRoot\System32\DRIVERS\ndistapi.sys
0xB71B9000 \SystemRoot\System32\DRIVERS\ndiswan.sys
0xB81B8000 \SystemRoot\System32\DRIVERS\raspppoe.sys
0xB81C8000 \SystemRoot\System32\DRIVERS\raspptp.sys
0xB8368000 \SystemRoot\System32\DRIVERS\TDI.SYS
0xB71A8000 \SystemRoot\System32\DRIVERS\psched.sys
0xB81D8000 \SystemRoot\System32\DRIVERS\msgpc.sys
0xB8370000 \SystemRoot\System32\DRIVERS\ptilink.sys
0xB8378000 \SystemRoot\System32\DRIVERS\raspti.sys
0xB7150000 \SystemRoot\System32\DRIVERS\rdpdr.sys
0xB81E8000 \SystemRoot\System32\DRIVERS\termdd.sys
0xB85C6000 \SystemRoot\System32\DRIVERS\swenum.sys
0xB7052000 \SystemRoot\System32\DRIVERS\update.sys
0xB858C000 \SystemRoot\System32\DRIVERS\mssmbios.sys
0xB8218000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xB8228000 \SystemRoot\System32\DRIVERS\usbhub.sys
0xB8238000 \SystemRoot\system32\DRIVERS\NVENETFD.sys
0xB3F75000 \SystemRoot\system32\drivers\RtkHDAud.sys
0xB3F51000 \SystemRoot\system32\drivers\portcls.sys
0xB8258000 \SystemRoot\system32\drivers\drmk.sys
0xB85D0000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xB87C5000 \SystemRoot\System32\Drivers\Null.SYS
0xB85D2000 \SystemRoot\System32\Drivers\Beep.SYS
0xB83A0000 \SystemRoot\System32\DRIVERS\HIDPARSE.SYS
0xB83A8000 \SystemRoot\System32\drivers\vga.sys
0xB85D4000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xB85D6000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xB83B0000 \SystemRoot\System32\Drivers\Msfs.SYS
0xB83B8000 \SystemRoot\System32\Drivers\Npfs.SYS
0xB8560000 \SystemRoot\System32\DRIVERS\rasacd.sys
0xB3B97000 \SystemRoot\System32\DRIVERS\ipsec.sys
0xB3B3E000 \SystemRoot\System32\DRIVERS\tcpip.sys
0xB3B04000 \SystemRoot\System32\Drivers\avgtdix.sys
0xB3ADE000 \SystemRoot\System32\DRIVERS\ipnat.sys
0xB8268000 \SystemRoot\System32\DRIVERS\wanarp.sys
0xB3822000 \SystemRoot\System32\DRIVERS\netbt.sys
0xB3800000 \SystemRoot\System32\drivers\afd.sys
0xB8288000 \SystemRoot\System32\DRIVERS\netbios.sys
0xB3735000 \SystemRoot\System32\DRIVERS\rdbss.sys
0xB370C000 \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys
0xB83C8000 \??\C:\Documents and Settings\All Users\Application Data\Trusteer\Rapport\store\exts\RapportCerberus\1 9917\RapportCerberus_19917.sys
0xB369C000 \SystemRoot\System32\DRIVERS\mrxsmb.sys
0xB82B8000 \SystemRoot\System32\Drivers\Fips.SYS
0xB86AA000 \SystemRoot\System32\Drivers\BANTExt.sys
0xB83D0000 \SystemRoot\System32\Drivers\avgmfx86.sys
0xB3668000 \SystemRoot\System32\Drivers\avgldx86.sys
0xB37D0000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xB364E000 \SystemRoot\System32\Drivers\dump_nvata.sys
0xB85E2000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xB3F4D000 \SystemRoot\System32\drivers\Dxapi.sys
0xB8408000 \SystemRoot\System32\watchdog.sys
0xBD000000 \SystemRoot\System32\drivers\dxg.sys
0xB8710000 \SystemRoot\System32\drivers\dxgthk.sys
0xBD012000 \SystemRoot\System32\nv4_disp.dll
0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
0xB2F92000 \SystemRoot\System32\DRIVERS\ndisuio.sys
0xB2B99000 \SystemRoot\System32\DRIVERS\mrxdav.sys
0xB8648000 \SystemRoot\System32\Drivers\ParVdm.SYS
0xB2ABD000 \SystemRoot\System32\Drivers\MASPINT.SYS
0xB2AA9000 \SystemRoot\system32\DRIVERS\mdmxsdk.sys
0xB29D9000 \SystemRoot\System32\DRIVERS\srv.sys
0xB83F0000 \SystemRoot\system32\drivers\npf.sys
0xB24E8000 \SystemRoot\System32\Drivers\HTTP.sys
0xB2433000 \SystemRoot\system32\drivers\wdmaud.sys
0xB26F9000 \SystemRoot\system32\drivers\sysaudio.sys
0xB8440000 \SystemRoot\System32\Drivers\AFGSp50.sys
0xB1028000 \??\C:\DOCUME~1\D\LOCALS~1\Temp\pxdoypod.sys
0xB0FFD000 \SystemRoot\system32\drivers\kmixer.sys
0x7C900000 \WINDOWS\system32\ntdll.dll

Processes (total 46):
0 System Idle Process
4 System
628 C:\WINDOWS\system32\smss.exe
676 csrss.exe
700 C:\WINDOWS\system32\winlogon.exe
744 C:\WINDOWS\system32\services.exe
756 C:\WINDOWS\system32\lsass.exe
908 C:\WINDOWS\system32\nvsvc32.exe
944 C:\WINDOWS\system32\svchost.exe
992 svchost.exe
1032 C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe
1108 C:\WINDOWS\system32\svchost.exe
1176 svchost.exe
1216 C:\Program Files\AVG\AVG9\avgchsvx.exe
1224 C:\Program Files\AVG\AVG9\avgrsx.exe
1304 svchost.exe
1332 C:\Program Files\AVG\AVG9\avgcsrvx.exe
1532 C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
1660 C:\WINDOWS\system32\spoolsv.exe
1736 svchost.exe
1768 C:\Program Files\Virgin Broadband Wireless\AffinegyService.exe
1788 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
1804 C:\Program Files\AVG\AVG9\avgwdsvc.exe
1824 C:\Program Files\Bonjour\mDNSResponder.exe
1936 C:\Program Files\Kontiki\KService.exe
204 C:\Program Files\AVG\AVG9\avgnsx.exe
280 C:\Program Files\WinPcap\rpcapd.exe
516 C:\WINDOWS\system32\svchost.exe
2076 unsecapp.exe
2104 alg.exe
2120 wmiprvse.exe
2388 C:\WINDOWS\system32\svchost.exe
2756 C:\WINDOWS\explorer.exe
2960 C:\Program Files\Trusteer\Rapport\bin\RapportService.exe
3104 C:\WINDOWS\system32\rundll32.exe
3132 C:\WINDOWS\RTHDCPL.exe
3184 C:\Program Files\Virgin Broadband Wireless\Wireless Manager.exe
3204 C:\Program Files\Entriq\MediaSphere\EntriqMediaTray.exe
3340 C:\Program Files\iTunes\iTunesHelper.exe
1052 C:\Program Files\Entriq\MediaSphere\3.8.2.9\EntriqMediaServer .exe
2608 C:\WINDOWS\system32\ctfmon.exe
3868 C:\Program Files\Messenger\msmsgs.exe
1168 C:\Program Files\Virgin Broadband Wireless\ndis_events.exe
2752 C:\Program Files\iPod\bin\iPodService.exe
284 C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
412 C:\Documents and Settings\D\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)

PhysicalDrive0 Model Number: WDCWD3200AAJS-00L7A0, Rev: 01.03E01

Size Device Name MBR Status
--------------------------------------------
298 GB \\.\PhysicalDrive0


DDS (Ver_10-12-12.02) - NTFSx86
Run by D at 14:05:23.45 on 25/01/2011
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.1919.1197 [GMT 0:00]

AV: AVG Anti-Virus Free *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}

============== Running Processes ===============

C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Virgin Broadband Wireless\AffinegyService.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Kontiki\KService.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\Program Files\WinPcap\rpcapd.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Virgin Broadband Wireless\Wireless Manager.exe
C:\Program Files\Entriq\MediaSphere\EntriqMediaTray.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Entriq\MediaSphere\3.8.2.9\EntriqMediaServer .exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Trusteer\Rapport\bin\RapportService.exe
C:\Program Files\Virgin Broadband Wireless\ndis_events.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Documents and Settings\D\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.searchy.co.uk/
uInternet Settings,ProxyOverride = *.local
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRunOnce: [Shockwave Updater] c:\windows\system32\adobe\shockwave 11\SwHelper_1150596.exe -Update -1150596 -"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" -"http://www.freeonlinegames.com/game/dawn-of-the-dead.html"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [REGSHAVE] c:\program files\regshave\REGSHAVE.EXE /AUTORUN
mRun: [nwiz] nwiz.exe /installquiet
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [Alcmtr] ALCMTR.EXE
mRun: [Wireless Manager] "c:\program files\virgin broadband wireless\Wireless Manager.exe" startup
mRun: [five Media Manager Tray] "c:\program files\entriq\mediasphere\EntriqMediaTray.exe" /CustomId:five
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
IE: &Search
IE: Free YouTube to Mp3 Converter - c:\documents and settings\d\application data\dvdvideosoftiehelpers\youtubetomp3.htm
IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_96D6 FF0C6D236BF8.dll/cmsidewiki.html
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {EBD24BD3-E272-4FA3-A8BA-C5D709757CAB} - {EBD24BD3-E272-4FA3-A8BA-C5D709757CAB} - c:\program files\playsushi\PSText.dll
DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1234968617747
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1268926494218
DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} - hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-27-0.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {FD0EBBED-0C42-4D0F-82DA-44399B5C420A} - hxxp://downloads.virginmedia.com/CST/ver1/xp_mail.cab
Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\program files\belarc\advisor\system\BAVoilaX.dll
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll
Notify: avgrsstarter - avgrsstx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
Hosts: 127.0.0.1 www.spywareinfo.com
Hosts: 69.10.57.34 Google
Hosts: 69.10.57.34 google.com
Hosts: 69.10.57.34 google.com.au
Hosts: 69.10.57.34 Google

Note: multiple HOSTS entries found. Please refer to Attach.txt

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2010-1-2 64288]
R0 RapportKELL;RapportKELL;c:\windows\system32\driver s\RapportKELL.sys [2010-10-3 59240]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-5-5 216400]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-5-5 29584]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-5-5 243024]
R1 RapportCerberus_19917;RapportCerberus_19917;c:\doc uments and settings\all users\application data\trusteer\rapport\store\exts\rapportcerberus\1 9917\RapportCerberus_19917.sys [2010-10-3 34792]
R1 RapportPG;RapportPG;c:\program files\trusteer\rapport\bin\RapportPG.sys [2010-10-3 169320]
R2 avg9wd;AVG Free WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2010-3-15 308136]
R2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2010-3-20 32512]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-2-21 135664]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-12-2 1181328]
S3 FLASHSYS;FLASHSYS;c:\program files\msi\live update 4\lu4\FlashSys.sys [2010-3-18 9216]

=============== Created Last 30 ================

2011-01-24 12:50:51 388096 ----a-r- c:\docume~1\d\applic~1\microsoft\installer\{45a667 26-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe
2011-01-22 18:16:22 -------- d-----w- c:\windows\system32\wbem\repository\FS
2011-01-22 18:16:22 -------- d-----w- c:\windows\system32\wbem\Repository

==================== Find3M ====================

2010-11-18 18:12:44 81920 ----a-w- c:\windows\system32\isign32.dll
2010-11-09 14:52:35 249856 ----a-w- c:\windows\system32\odbc32.dll
2010-11-06 00:26:58 916480 ----a-w- c:\windows\system32\wininet.dll
2010-11-06 00:26:58 43520 ----a-w- c:\windows\system32\licmgr10.dll
2010-11-06 00:26:58 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2010-11-03 12:25:54 385024 ----a-w- c:\windows\system32\html.iec
2010-10-28 13:13:22 290048 ----a-w- c:\windows\system32\atmfd.dll

============= FINISH: 14:06:38.92 ===============


UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-12-12.02)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 13/02/2009 17:41:39
System Uptime: 25/01/2011 13:55:11 (1 hours ago)

Motherboard: MSI | | MS-7309
Processor: AMD Athlon(tm) 64 X2 Dual Core Processor 5200+ | CPU 1 | 2712/200mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 128 GiB total, 107.278 GiB free.
D: is CDROM ()

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP161: 21/10/2010 17:23:04 - System Checkpoint
RP162: 22/10/2010 19:13:18 - System Checkpoint
RP163: 25/10/2010 20:54:35 - Installed Java(TM) 6 Update 22
RP164: 25/10/2010 21:59:06 - Restore Operation
RP165: 26/10/2010 14:38:23 - Avg Update
RP166: 30/10/2010 21:57:22 - System Checkpoint
RP167: 01/11/2010 15:58:49 - System Checkpoint
RP168: 02/11/2010 16:00:54 - System Checkpoint
RP169: 10/11/2010 11:16:13 - Avg Update
RP170: 10/11/2010 11:16:58 - Avg Update
RP171: 10/11/2010 12:24:27 - Software Distribution Service 3.0
RP172: 12/11/2010 19:45:53 - System Checkpoint
RP173: 14/11/2010 20:14:06 - System Checkpoint
RP174: 18/11/2010 14:03:09 - System Checkpoint
RP175: 20/11/2010 22:14:09 - Software Distribution Service 3.0
RP176: 23/11/2010 21:00:40 - System Checkpoint
RP177: 25/11/2010 13:13:40 - Avg Update
RP178: 25/11/2010 13:14:43 - Avg Update
RP179: 26/11/2010 20:08:05 - System Checkpoint
RP180: 29/11/2010 17:30:13 - System Checkpoint
RP181: 04/12/2010 18:29:11 - System Checkpoint
RP182: 13/12/2010 19:46:57 - System Checkpoint
RP183: 15/12/2010 21:25:08 - Installed Java(TM) 6 Update 23
RP184: 16/12/2010 14:17:59 - Software Distribution Service 3.0
RP185: 28/12/2010 15:22:09 - System Checkpoint
RP186: 05/01/2011 20:47:36 - System Checkpoint
RP187: 06/01/2011 15:42:08 - Software Distribution Service 3.0
RP188: 10/01/2011 20:05:56 - System Checkpoint
RP189: 12/01/2011 20:02:55 - System Checkpoint
RP190: 13/01/2011 19:00:36 - Software Distribution Service 3.0
RP191: 18/01/2011 18:05:32 - Installed Java(TM) 6 Update 23
RP192: 18/01/2011 18:06:38 - Installed Java(TM) 6 Update 23
RP193: 19/01/2011 18:07:57 - Removed Java(TM) 6 Update 13
RP194: 19/01/2011 18:08:50 - Installed Java(TM) 6 Update 23
RP195: 22/01/2011 18:15:28 - Restore Operation
RP196: 24/01/2011 12:50:50 - Installed HiJackThis
RP197: 24/01/2011 12:51:59 - Software Distribution Service 3.0

==== Hosts File Hijack ======================

Hosts: 127.0.0.1 www.spywareinfo.com
Hosts: 69.10.57.34 Google
Hosts: 69.10.57.34 google.com
Hosts: 69.10.57.34 google.com.au
Hosts: 69.10.57.34 Google
Hosts: 69.10.57.34 google.be
Hosts: 69.10.57.34 Google
Hosts: 69.10.57.34 google.com.br
Hosts: 69.10.57.34 Google
Hosts: 69.10.57.34 google.ca
Hosts: 69.10.57.34 Google
Hosts: 69.10.57.34 google.ch
Hosts: 69.10.57.34 Google
Hosts: 69.10.57.34 google.de
Hosts: 69.10.57.34 Google
Hosts: 69.10.57.34 google.dk
Hosts: 69.10.57.34 Google
Hosts: 69.10.57.34 google.fr
Hosts: 69.10.57.34 Google
Hosts: 69.10.57.34 google.ie
Hosts: 69.10.57.34 Google
Hosts: 69.10.57.34 google.it
Hosts: 69.10.57.34 Google
Hosts: 69.10.57.34 google.co.jp
Hosts: 69.10.57.34 Google
Hosts: 69.10.57.34 google.nl
Hosts: 69.10.57.34 Google
Hosts: 69.10.57.34 google.no
Hosts: 69.10.57.34 Google
Hosts: 69.10.57.34 google.co.nz
Hosts: 69.10.57.34 Google
Hosts: 69.10.57.34 google.pl
Hosts: 69.10.57.34 Google
Hosts: 69.10.57.34 google.se
Hosts: 69.10.57.34 Google
Hosts: 69.10.57.34 google.co.uk
Hosts: 69.10.57.34 Google
Hosts: 69.10.57.34 google.co.za
Hosts: 69.10.57.34 Google
Hosts: 69.10.57.34 Google Analytics | Official Website
Hosts: 69.10.57.34 Bing
Hosts: 69.10.57.34 search.yahoo.com
Hosts: 69.10.57.34 Yahoo! Search - Web Search
Hosts: 69.10.57.34 uk.search.yahoo.com
Hosts: 69.10.57.34 ca.search.yahoo.com
Hosts: 69.10.57.34 de.search.yahoo.com
Hosts: 69.10.57.34 fr.search.yahoo.com
Hosts: 69.10.57.34 au.search.yahoo.com

==== Installed Programs ======================

Acrobat.com
Ad-Aware
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Reader 9.3.3
Adobe Shockwave Player 11.5
All Say Cheese Photobook Creator
Apple Application Support
Apple Mobile Device Support
Apple Software Update
AVG Free 9.0
Belarc Advisor 7.2
Bonjour
Catalyst Control Center Core Implementation
Catalyst Control Center Graphics Full Existing
Catalyst Control Center Graphics Full New
Catalyst Control Center Graphics Light
Catalyst Control Center Graphics Previews Common
ccc-core-preinstall
ccc-core-static
ccc-utility
CCC Help English
CCleaner
Demand Five Player
Email Updater
EPSON Printer Software
Facebook Plug-In
FinePixViewer Ver.4.0
Free Audio CD Burner version 1.4
Free YouTube to MP3 Converter version 3.8
FUJIFILM USB Driver
Google Update Helper
High Definition Audio Driver Package - KB888111
HiJackThis
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB2158563)
Hotfix for Windows XP (KB2443685)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976002-v5)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
ImageMixer VCD for FinePix
iTunes
Java(TM) 6 Update 17
Liveupdate4
Malwarebytes' Anti-Malware
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB2416447)
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Base Smart Card Cryptographic Service Provider Package
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office 97, Professional Edition
Microsoft Silverlight
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Works 7.0
MicroStaff WINASPI NT
NavDesk 2008
NVIDIA Display Control Panel
NVIDIA Drivers
NVIDIA nView Desktop Manager
NVIDIA PhysX
Photo Viewer
Plants vs. Zombies
QuickTime
Rapport
RAW FILE CONVERTER LE
Realtek High Definition Audio Driver
Scientific-Atlanta WebSTAR 2000 series Cable Modem
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
Security Update for Windows Internet Explorer 7 (KB938127-v2)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 8 (KB2183461)
Security Update for Windows Internet Explorer 8 (KB2360131)
Security Update for Windows Internet Explorer 8 (KB2416400)
Security Update for Windows Internet Explorer 8 (KB969897)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB972260)
Security Update for Windows Internet Explorer 8 (KB974455)
Security Update for Windows Internet Explorer 8 (KB976325)
Security Update for Windows Internet Explorer 8 (KB978207)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2121546)
Security Update for Windows XP (KB2160329)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2259922)
Security Update for Windows XP (KB2279986)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2296199)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB2419632)
Security Update for Windows XP (KB2423089)
Security Update for Windows XP (KB2436673)
Security Update for Windows XP (KB2440591)
Security Update for Windows XP (KB2443105)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB938464-v2)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981852)
Security Update for Windows XP (KB981957)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982132)
Security Update for Windows XP (KB982214)
Security Update for Windows XP (KB982665)
Security Update for Windows XP (KB982802)
Skins
Spybot - Search & Destroy
Uninstall 1.0.0.1
Uninstall Entriq MediaSphere
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Windows (KB971513)
Update for Windows Internet Explorer 8 (KB969497)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows Internet Explorer 8 (KB976749)
Update for Windows Internet Explorer 8 (KB978506)
Update for Windows Internet Explorer 8 (KB980182)
Update for Windows XP (KB2141007)
Update for Windows XP (KB2345886)
Update for Windows XP (KB2467659)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
VLC media player 1.0.5
VoiceOver Kit
WebFldrs XP
Windows Driver Package - (mr7910) Image (08/08/2006 1.4.0.0)
Windows Driver Package - Advanced Micro Devices (AmdK8) Processor (05/27/2006 1.3.2.0)
Windows Driver Package - AMD System (04/06/2006 1.0.1.0)
Windows Genuine Advantage Notifications (KB905474)
Windows Internet Explorer 7
Windows Internet Explorer 8
Windows Media Format 11 runtime
Windows Media Player 11
Windows PowerShell(TM) 1.0
Windows XP Service Pack 3
Wireless Manager

==== Event Viewer Messages From Past Week ========

25/01/2011 14:05:55, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the rpcapd service.
25/01/2011 12:49:55, error: Service Control Manager [7031] - The Lavasoft Ad-Aware Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service.
25/01/2011 12:49:49, error: Service Control Manager [7034] - The Remote Packet Capture Protocol v.0 (experimental) service terminated unexpectedly. It has done this 1 time(s).
25/01/2011 12:49:49, error: Service Control Manager [7034] - The iPod Service service terminated unexpectedly. It has done this 1 time(s).
25/01/2011 12:49:48, error: Service Control Manager [7034] - The NVIDIA Display Driver Service service terminated unexpectedly. It has done this 1 time(s).
25/01/2011 12:49:48, error: Service Control Manager [7034] - The KService service terminated unexpectedly. It has done this 1 time(s).
25/01/2011 12:49:48, error: Service Control Manager [7034] - The Bonjour Service service terminated unexpectedly. It has done this 1 time(s).
25/01/2011 12:49:48, error: Service Control Manager [7034] - The AffinegyService service terminated unexpectedly. It has done this 1 time(s).
25/01/2011 12:49:48, error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
24/01/2011 17:49:49, error: Dhcp [1002] - The IP address lease 192.168.1.2 for the Network Card with network address 002421B2D830 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).
24/01/2011 13:11:25, error: W32Time [17] - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 30 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751)
24/01/2011 1207, error: W32Time [17] - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751)
22/01/2011 17:20:04, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
22/01/2011 16:30:47, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
22/01/2011 16:30:38, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
22/01/2011 16:30:23, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD AmdK8 AvgLdx86 AvgMfx86 AvgTdiX BANTExt Fips IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss Tcpip
22/01/2011 16:30:23, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD Networking Support Environment service which failed to start because of the following error: A device attached to the system is not functioning.
22/01/2011 16:30:23, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
22/01/2011 16:30:23, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
22/01/2011 16:30:23, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.
22/01/2011 16:30:23, error: Service Control Manager [7001] - The Bonjour Service service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
22/01/2011 16:30:23, error: Service Control Manager [7001] - The Apple Mobile Device service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
22/01/2011 16:24:20, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the NVIDIA Display Driver Service service to connect.
22/01/2011 16:24:20, error: Service Control Manager [7000] - The NVIDIA Display Driver Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
22/01/2011 15:00:49, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the AVG Free WatchDog service to connect.
22/01/2011 15:00:49, error: Service Control Manager [7000] - The AVG Free WatchDog service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
22/01/2011 15:00:10, error: Service Control Manager [7031] - The AVG Free WatchDog service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.
22/01/2011 13:55:26, error: DCOM [10005] - DCOM got error "%1055" attempting to start the service winmgmt with arguments "" in order to run the server: {8BC3F05E-D86B-11D0-A075-00C04FB68820}
22/01/2011 13:55:26, error: DCOM [10005] - DCOM got error "%1055" attempting to start the service iPod Service with arguments "" in order to run the server: {063D34A4-BF84-4B8D-B699-E8CA06504DDE}
22/01/2011 13:55:26, error: DCOM [10005] - DCOM got error "%1055" attempting to start the service BITS with arguments "" in order to run the server: {4991D34B-80A1-4291-83B6-3328366B9097}
20/01/2011 18:14:53, error: Service Control Manager [7000] - The Ati External Event Utility service failed to start due to the following error: The system cannot find the file specified.
20/01/2011 15:03:21, error: Dhcp [1002] - The IP address lease 192.168.1.3 for the Network Card with network address 002421B2D830 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).
18/01/2011 15:02:55, error: Dhcp [1002] - The IP address lease 192.168.1.4 for the Network Card with network address 002421B2D830 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).

==== End Of File ===========================

I'm still getting lots of random bad pop ups on hooking up to the 'net, even just here, on DAL...I reckon those 01 host google pages can't be helping my issue?

Cheers, Dave, and thanks for your time : )

MBRCheck log seems to be incomplete.
Please, repost it.

I'm not sure if I'm having trouble with the MBRCheck programme. I've run it 3 times and a black screen does indeed come up, then the pc freezes,everytime.My mouse works but nothing is clickable, so I have to press the restart button. Upon restart, there's an mbr log on the desktop,but everytime I run it, the log looks virtually the same.
Here's my latest MBRCheck log:

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Professional
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x0000000c

Kernel Drivers (total 120):
0x804D7000 \WINDOWS\system32\ntkrnlpa.exe
0x806E4000 \WINDOWS\system32\hal.dll
0xB85A8000 \WINDOWS\system32\KDCOM.DLL
0xB84B8000 \WINDOWS\system32\BOOTVID.dll
0xB7F79000 ACPI.sys
0xB85AA000 \WINDOWS\System32\DRIVERS\WMILIB.SYS
0xB7F68000 pci.sys
0xB80A8000 isapnp.sys
0xB8670000 pciide.sys
0xB8328000 \WINDOWS\System32\DRIVERS\PCIIDEX.SYS
0xB80B8000 MountMgr.sys
0xB7F49000 ftdisk.sys
0xB85AC000 dmload.sys
0xB7F23000 dmio.sys
0xB8330000 PartMgr.sys
0xB80C8000 VolSnap.sys
0xB7F0B000 atapi.sys
0xB7EE7000 nvgts.sys
0xB7ECF000 \WINDOWS\system32\DRIVERS\SCSIPORT.SYS
0xB7EB5000 nvata.sys
0xB80D8000 disk.sys
0xB80E8000 \WINDOWS\System32\DRIVERS\CLASSPNP.SYS
0xB7E95000 fltmgr.sys
0xB7E83000 sr.sys
0xB80F8000 Lbd.sys
0xB7E6C000 KSecDD.sys
0xB7DDF000 Ntfs.sys
0xB7DB2000 NDIS.sys
0xB8108000 RapportKELL.sys
0xB85AE000 \WINDOWS\System32\Drivers\USBD.SYS
0xB7D98000 Mup.sys
0xB8308000 \SystemRoot\system32\DRIVERS\AmdK8.sys
0xB8318000 \SystemRoot\System32\DRIVERS\serial.sys
0xB8564000 \SystemRoot\System32\DRIVERS\serenum.sys
0xB7538000 \SystemRoot\System32\DRIVERS\parport.sys
0xB8138000 \SystemRoot\System32\DRIVERS\i8042prt.sys
0xB8478000 \SystemRoot\System32\DRIVERS\kbdclass.sys
0xB8480000 \SystemRoot\System32\DRIVERS\mouclass.sys
0xB8488000 \SystemRoot\System32\DRIVERS\usbohci.sys
0xB7514000 \SystemRoot\System32\DRIVERS\USBPORT.SYS
0xB8490000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xB74EC000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0xB8148000 \SystemRoot\system32\DRIVERS\imapi.sys
0xB8158000 \SystemRoot\System32\DRIVERS\cdrom.sys
0xB8168000 \SystemRoot\System32\DRIVERS\redbook.sys
0xB74C9000 \SystemRoot\System32\DRIVERS\ks.sys
0xB8498000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
0xB8178000 \SystemRoot\system32\DRIVERS\nvnetbus.sys
0xB73AD000 \SystemRoot\system32\DRIVERS\NVNRM.SYS
0xB69E0000 \SystemRoot\system32\DRIVERS\nv4_mini.sys
0xB69CC000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xB879B000 \SystemRoot\System32\DRIVERS\audstub.sys
0xB8188000 \SystemRoot\System32\DRIVERS\rasl2tp.sys
0xB856C000 \SystemRoot\System32\DRIVERS\ndistapi.sys
0xB69B5000 \SystemRoot\System32\DRIVERS\ndiswan.sys
0xB8198000 \SystemRoot\System32\DRIVERS\raspppoe.sys
0xB81A8000 \SystemRoot\System32\DRIVERS\raspptp.sys
0xB84A0000 \SystemRoot\System32\DRIVERS\TDI.SYS
0xB69A4000 \SystemRoot\System32\DRIVERS\psched.sys
0xB81B8000 \SystemRoot\System32\DRIVERS\msgpc.sys
0xB84A8000 \SystemRoot\System32\DRIVERS\ptilink.sys
0xB84B0000 \SystemRoot\System32\DRIVERS\raspti.sys
0xB6974000 \SystemRoot\System32\DRIVERS\rdpdr.sys
0xB81C8000 \SystemRoot\System32\DRIVERS\termdd.sys
0xB85D8000 \SystemRoot\System32\DRIVERS\swenum.sys
0xB6876000 \SystemRoot\System32\DRIVERS\update.sys
0xB8588000 \SystemRoot\System32\DRIVERS\mssmbios.sys
0xB81F8000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xB8218000 \SystemRoot\System32\DRIVERS\usbhub.sys
0xB8228000 \SystemRoot\system32\DRIVERS\NVENETFD.sys
0xB33E4000 \SystemRoot\system32\drivers\RtkHDAud.sys
0xB33C0000 \SystemRoot\system32\drivers\portcls.sys
0xB8248000 \SystemRoot\system32\drivers\drmk.sys
0xB85E2000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xB877E000 \SystemRoot\System32\Drivers\Null.SYS
0xB85E4000 \SystemRoot\System32\Drivers\Beep.SYS
0xB8390000 \SystemRoot\System32\DRIVERS\HIDPARSE.SYS
0xB8398000 \SystemRoot\System32\drivers\vga.sys
0xB85E6000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xB85E8000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xB83A0000 \SystemRoot\System32\Drivers\Msfs.SYS
0xB83A8000 \SystemRoot\System32\Drivers\Npfs.SYS
0xB7558000 \SystemRoot\System32\DRIVERS\rasacd.sys
0xB30CD000 \SystemRoot\System32\DRIVERS\ipsec.sys
0xB3074000 \SystemRoot\System32\DRIVERS\tcpip.sys
0xB303A000 \SystemRoot\System32\Drivers\avgtdix.sys
0xB3014000 \SystemRoot\System32\DRIVERS\ipnat.sys
0xB8268000 \SystemRoot\System32\DRIVERS\wanarp.sys
0xB2FC4000 \SystemRoot\System32\DRIVERS\netbt.sys
0xB2FA2000 \SystemRoot\System32\drivers\afd.sys
0xB8278000 \SystemRoot\System32\DRIVERS\netbios.sys
0xB2ED7000 \SystemRoot\System32\DRIVERS\rdbss.sys
0xB2EAE000 \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys
0xB83B0000 \??\C:\Documents and Settings\All Users\Application Data\Trusteer\Rapport\store\exts\RapportCerberus\1 9917\RapportCerberus_19917.sys
0xB2E3E000 \SystemRoot\System32\DRIVERS\mrxsmb.sys
0xB82A8000 \SystemRoot\System32\Drivers\Fips.SYS
0xB87A6000 \SystemRoot\System32\Drivers\BANTExt.sys
0xB83B8000 \SystemRoot\System32\Drivers\avgmfx86.sys
0xB2E0A000 \SystemRoot\System32\Drivers\avgldx86.sys
0xB68E4000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xB2DF0000 \SystemRoot\System32\Drivers\dump_nvata.sys
0xB85F6000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xB337E000 \SystemRoot\System32\drivers\Dxapi.sys
0xB83F0000 \SystemRoot\System32\watchdog.sys
0xBD000000 \SystemRoot\System32\drivers\dxg.sys
0xB868A000 \SystemRoot\System32\drivers\dxgthk.sys
0xBD012000 \SystemRoot\System32\nv4_disp.dll
0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
0xB238A000 \SystemRoot\System32\DRIVERS\mrxdav.sys
0xB864C000 \SystemRoot\System32\Drivers\ParVdm.SYS
0xB228E000 \SystemRoot\System32\Drivers\MASPINT.SYS
0xB22BA000 \SystemRoot\system32\DRIVERS\mdmxsdk.sys
0xB20DA000 \SystemRoot\System32\DRIVERS\srv.sys
0xB8438000 \SystemRoot\system32\drivers\npf.sys
0xB1C89000 \SystemRoot\System32\Drivers\HTTP.sys
0xB1BFC000 \SystemRoot\system32\drivers\wdmaud.sys
0xB1E0A000 \SystemRoot\system32\drivers\sysaudio.sys
0xB8378000 \SystemRoot\System32\Drivers\AFGSp50.sys
0x7C900000 \WINDOWS\system32\ntdll.dll

Processes (total 47):
0 System Idle Process
4 System
628 C:\WINDOWS\system32\smss.exe
676 csrss.exe
700 C:\WINDOWS\system32\winlogon.exe
744 C:\WINDOWS\system32\services.exe
756 C:\WINDOWS\system32\lsass.exe
908 C:\WINDOWS\system32\nvsvc32.exe
944 C:\WINDOWS\system32\svchost.exe
992 svchost.exe
1032 C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe
1108 C:\WINDOWS\system32\svchost.exe
1160 svchost.exe
1180 C:\Program Files\AVG\AVG9\avgchsvx.exe
1188 C:\Program Files\AVG\AVG9\avgrsx.exe
1256 svchost.exe
1292 C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
1312 C:\Program Files\AVG\AVG9\avgcsrvx.exe
1564 C:\WINDOWS\system32\spoolsv.exe
1664 svchost.exe
1728 C:\Program Files\Virgin Broadband Wireless\AffinegyService.exe
1744 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
1768 C:\Program Files\AVG\AVG9\avgwdsvc.exe
1788 C:\Program Files\Bonjour\mDNSResponder.exe
1876 C:\Program Files\Kontiki\KService.exe
2020 C:\Program Files\AVG\AVG9\avgnsx.exe
124 C:\Program Files\Google\Update\GoogleUpdate.exe
328 C:\Program Files\WinPcap\rpcapd.exe
564 C:\WINDOWS\system32\svchost.exe
2108 unsecapp.exe
2140 wmiprvse.exe
2148 alg.exe
2752 C:\WINDOWS\system32\svchost.exe
2768 C:\WINDOWS\explorer.exe
2836 C:\Program Files\Trusteer\Rapport\bin\RapportService.exe
3120 C:\WINDOWS\system32\rundll32.exe
3136 C:\WINDOWS\RTHDCPL.exe
3160 C:\Program Files\Virgin Broadband Wireless\Wireless Manager.exe
3172 C:\Program Files\Entriq\MediaSphere\EntriqMediaTray.exe
3072 C:\Program Files\Entriq\MediaSphere\3.8.2.9\EntriqMediaServer .exe
264 C:\Program Files\iTunes\iTunesHelper.exe
2636 C:\WINDOWS\system32\ctfmon.exe
3536 C:\Program Files\Messenger\msmsgs.exe
2484 C:\Program Files\Virgin Broadband Wireless\ndis_events.exe
3340 C:\Program Files\iPod\bin\iPodService.exe
2860 C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
1916 C:\Documents and Settings\D\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)

PhysicalDrive0 Model Number: WDCWD3200AAJS-00L7A0, Rev: 01.03E01

Size Device Name MBR Status
--------------------------------------------
298 GB \\.\PhysicalDrive0

Same issue...

Let's try different tool.

Download Bootkit Remover to your Desktop.

• You then need to extract the remover.exe file from the RAR using a program capable of extracing RAR compressed files. If you don't have an extraction program, you can use 7-Zip: 7-Zip
• After extracing remover.exe to your Desktop, double-click on remover.exe to run the program (Vista/7 users,right click on remover.exe and click Run As Administrator).
• It will show a Black screen with some data on it.
• Right click on the screen and click Select All.
• Press CTRL+C
• Open a Notepad and press CTRL+V
• Post the output back here.

Ok,
managed to fumble my way through that! I'm far from an expert.. had to download that 7-zip which eventually opened/ran Bootkit Remover, cheers.
Oh, not sure if I downloaded the right version,(there are 2, 32 bit and 64?),anyway, I got a warning something like this:
ATA-PASS-THROUGH-DIRECT not supported by your disk controller
SCSI- " - " - " will be used for disk I/O

Here's the Bootkit Remover log:
Bootkit Remover
(c) 2009 eSage Lab
eSage Lab - Digital security research and consulting - Main

Program version: 1.2.0.0
OS Version: Microsoft Windows XP Professional Service Pack 3 (build 26

System volume is \\.\C:
\\.\C: -> \\.\PhysicalDrive0 at offset 0x00000000`00007e00
ATA_Read(): DeviceIoControl() ERROR 1
Boot sector MD5 is: 6def5ffcbcdbdb4082f1015625e597bd

Size Device Name MBR Status
--------------------------------------------
298 GB \\.\PhysicalDrive0 OK (DOS/Win32 Boot code found)


Done;
Press any key to quit...

Still getting random pop ups of mens American health, sexual bolony! what the heck! (this is the main,front room pc,it only ever gets used for run of the mill stuff/schoolwork etc..and this all started while the young un was on Facebook!)...and my browser keeps going off on one, you can see the toolbar searching for loads of ad sites etc, and it even keeps re directing my page away, but so far DAL keeps thankfully 'recovering the tab'.

Cheers, Dave.

MBR looks good

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

1. Please, never rename Combofix unless instructed.
2. Close any open browsers.
3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
   
   • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
   • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
   
   NOTE1. If Combofix asks you to install Recovery Console, please allow it.
   NOTE 2. If Combofix asks you to update the program, always do so.
   
   • Close any open browsers.
   • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
   • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
   • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
4. Double click on combofix.exe & follow the prompts.
5. When finished, it will produce a report for you.
6. Please post the "C:\ComboFix.txt"

**Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
**Note 2 for AVG users: ComboFix will not run until AVG is uninstalled as a protective measure against the anti-virus. This is because AVG "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG first.
Use AppRemover to uninstall it: Uninstall & Remove McAfee, Symantec, Norton, AVG, Avast & More Antivirus and Security Applications and Programs
We can reinstall it when we're done with CF.
**Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.



Make sure, you re-enable your security programs, when you're done with Combofix.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~

NOTE.
If, for some reason, Combofix refuses to run, try one of the following:

1. Run Combofix from Safe Mode.

2. Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
Do NOT run it yet.

Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

There are 4 different versions. If one of them won't run then download and try to run the other one.

Vista and Win7 users need to right click Rkill and choose Run as Administrator

You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

Rkill.com
Rkill.scr
Rkill.exe

• Double-click on the Rkill desktop icon to run the tool.
• If using Vista or Windows 7 right-click on it and choose Run As Administrator.
• A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
• If not, delete the file, then download and use the one provided in Link 2.
• If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
• Do not reboot until instructed.
• If the tool does not run from any of the links provided, please let me know.

Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

If normal mode still doesn't work, run BOTH tools from safe mode.

In case #2, please post BOTH logs, rKill and Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

Cheers Broni,
I really appreciate your time/knowledge : )

I will proceed with your next step,but,
Sorry to sound dumb, but do I have to completely uninstall AVG, it won't work if I just 'disable' it?

Cheers, Dave : )

You have to uninstall AVG completely.