Persisten rootkits - SPBP.SYS, SPXZ.SYS

[YellowFinTuna]

Hello,

I'm running Windows XP Professional 32-bit (WXPp32) SP3 with all Windows Updates current. This computer is primarily used for gaming and became progressively slower and the useable diskspace appeared to be reducing depite not installing anything. I maintain a firewall but do not regularly check for malware. My dad ran AVG2012 free trial and we discovered that we had five (5) rootkits installed. AVG2012 attempted to remove them when they were named SPBP.SYS but now a new variant SPXZ.SYS has appeared, apparently hooked into atapi.sys.

HARDWARE
NVIDIA GeForce 9800 GT video card
3 * physical HDD (4 partitions)
4 GB physical RAM

Note that I am also running Daemon tools to establish virtual drives. I understand that some of the methods DT uses are similar in process to
rootkit establishment.

I have run ERUNT.
I am still running AVG2012 within the 30 day trial period. Rootkits are still being found. I am minimising my time on the net and considering a clean install of the system partition. Please advise.

ATTACHMENTS
DDS.txt (Attach_txt.zip not attached)
20120618A-AVG-Details-Rootkits-2.jpg (AVG screenshot)

QUESTIONS:
[1] Can you please help rid my PC of the rootkits ?
[2] Can you please advise of the usefulness of a clean install of WXPp32 ?

Thank you very much (in advance),
YellowFinTuna

[Blade81]

Hi,

Those are Daemon Tools drivers so it looks like false alarm.

[Blade81]

Due to inactivity, this thread will now be closed.

Note:If it has been three days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh DDS log and a link to your previous thread. Please do not add any logs that might have been requested in the closed topic, you would be starting fresh.

If it has been less than three days since your last response and you need the thread re-opened, please send me or other MOD a private message (pm). A valid, working link to the closed topic is required.