Again mpas-d.exe

But also: lzx32.sys

Name: Win23 lzx files loader
Filename: lzx32.sys
Command: C:\Windows\System32:lzx32.sys
Description: Added by the Troj/RKRustock-A rootkit. This infection utilizes Alternate Data Streams in order to hide itself.
File Location: %System%
Startup Type: This startup entry is installed as a Windows NT, 2000, 2003, or XP service.
Service Name: pe386
Service Display Name: Win23 lzx files loader


I would suggest reading this post: http://www.d-a-l.com/help/showthread.php?t=32403 then post a HijackThis log in that section.

If the problem persists after they give you an all clear please return here and we can try more things.

Perhaps Windows Defender quarantined that file or somehow got entangled with it.

All the dumps are caused by lzx32.sys. You can find out how to remove it HERE. I've posted here as I'm unable to post in the security forum.

THANK YOU! THANK YOU!
finally! i am out of safe mode, thank you!!