redirects web pages, errors, slow and locks up.

Lets try a few things.

Copy and paste these lines in Note pad.

@Echo on
pushd\windows\system32\drivers\etc
attrib -h -s -r hosts
echo 127.0.0.1 localhost>HOSTS
attrib +r +h +s hosts
popd
ipconfig /release
ipconfig /renew
ipconfig /flushdns
netsh winsock reset all
netsh int ip reset all
shutdown -r -t 1
del %0

Save as flush.bat to your desktop. Double click to run.
*** note: Win Vista and Win 7 need to right click and choose to "run as Administrator" .. the computer will reboot itself.






Download the HostsXpert 4.3 - Hosts File Manager.
  • Unzip HostsXpert 4.2.0.0 - Hosts File Manager to a convenient folder such as C:\HostsXpert
  • Click HostsXpert.exe to Run HostsXpert - Hosts File Manager from its new home
  • Click "Make Hosts Writable?" in the upper left corner.
  • Click Restore Microsoft's Hosts file and then click OK.
  • Click the X to exit the program.
  • Note: If you were using a custom Hosts file you will need to replace any of those entries yourself.





Open Internet Explorer and go to Tools > Internet Options > Advanced Tab > Reset Internet Explorer Settings > Reset .....takes a few seconds...then OK your way out , close IE and then reopen it and see if things are better, in the meantime I am going to look over your OTS log to make sure I didn't miss anything
 
after

after doing the above
a second tab tried to open when i opened IE, it showed (Connecting) and did not complete
then later a popup (registry errors tab-down load registry cleaner.) screen shot attached.
 
Thats a rogue program, whatever you do dont install it

1.Click Start -> All Programs -> Accessories -> System Tools, and then click Internet Explorer (No Add-ons).
See if this helped




Step 1 | Download MBRCheck.exe to your desktop.
  • Be sure to disable your security programs
  • Double click on the file to run it
  • A window will open on your desktop
  • if an unknown bootcode is found you will have further options available to you, at this time press N then press Enter twice.
  • If nothing unusual is found just press Enter
  • A .txt file named MBRCheck_mm.dd.yy_hh.mm.ss should appear on your desktop.
  • Please post the contents of that file.
 
Mbr

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Home Edition
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x0000001d

Kernel Drivers (total 132):
0x804D7000 \WINDOWS\system32\ntoskrnl.exe
0x806FF000 \WINDOWS\system32\hal.dll
0x86E9E000 \WINDOWS\system32\KDCOM.DLL
0xF79F9000 \WINDOWS\system32\BOOTVID.dll
0xF7596000 ACPI.sys
0xF7AE5000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xF7585000 pci.sys
0xF75E5000 isapnp.sys
0xF75F5000 ohci1394.sys
0xF7605000 \WINDOWS\system32\DRIVERS\1394BUS.SYS
0xF7BAD000 PCIIde.sys
0xF7865000 \WINDOWS\System32\Drivers\PCIIDEX.SYS
0xF7AE7000 intelide.sys
0xF7615000 MountMgr.sys
0xF7566000 ftdisk.sys
0xF786D000 PartMgr.sys
0xF7625000 VolSnap.sys
0xF754E000 atapi.sys
0xF7635000 disk.sys
0xF7645000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xF752E000 fltmgr.sys
0xF751C000 sr.sys
0xF7506000 SymSnap.sys
0xF74EF000 KSecDD.sys
0xF7462000 Ntfs.sys
0xF7435000 NDIS.sys
0xF741B000 Mup.sys
0xF76E5000 \SystemRoot\system32\DRIVERS\nic1394.sys
0xF7755000 \SystemRoot\system32\DRIVERS\intelppm.sys
0xF6BF8000 \SystemRoot\system32\DRIVERS\ati2mtag.sys
0xF6BE4000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xF7975000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0xF6BC0000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xF797D000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xF7765000 \SystemRoot\system32\DRIVERS\IntelC53.sys
0xF6B9D000 \SystemRoot\system32\DRIVERS\ks.sys
0xF6A55000 \SystemRoot\system32\DRIVERS\IntelC51.sys
0xF69BD000 \SystemRoot\system32\DRIVERS\IntelC52.sys
0xF2333000 \SystemRoot\system32\DRIVERS\mohfilt.sys
0xF2323000 \SystemRoot\System32\Drivers\Modem.SYS
0xF0857000 \SystemRoot\system32\DRIVERS\e100b325.sys
0xF0817000 \SystemRoot\system32\drivers\smwdm.sys
0xF07F3000 \SystemRoot\system32\drivers\portcls.sys
0xF276B000 \SystemRoot\system32\drivers\drmk.sys
0xF0740000 \SystemRoot\system32\drivers\senfilt.sys
0xF231B000 \SystemRoot\system32\DRIVERS\fdc.sys
0xF072C000 \SystemRoot\system32\DRIVERS\parport.sys
0xF1FFB000 \SystemRoot\system32\DRIVERS\serial.sys
0xF6D75000 \SystemRoot\system32\DRIVERS\serenum.sys
0xF1F9B000 \SystemRoot\system32\DRIVERS\imapi.sys
0xF0CEF000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xF7795000 \SystemRoot\system32\DRIVERS\redbook.sys
0xF089D000 \SystemRoot\System32\Drivers\GearAspiWDM.SYS
0xF7C1D000 \SystemRoot\system32\DRIVERS\audstub.sys
0xF7715000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xF6D7D000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xED45B000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xF27FB000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xF27AB000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xF79ED000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xEC809000 \SystemRoot\system32\DRIVERS\psched.sys
0xED814000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xF3E57000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xF3E4F000 \SystemRoot\system32\DRIVERS\raspti.sys
0xED12F000 \SystemRoot\system32\DRIVERS\termdd.sys
0xF3E47000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xF3E3F000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xF7B35000 \SystemRoot\system32\DRIVERS\swenum.sys
0xEC366000 \SystemRoot\system32\DRIVERS\update.sys
0xED3C9000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xECB0D000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xECAFD000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xF7B37000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xECC16000 \SystemRoot\system32\drivers\MODEMCSA.sys
0xF3E2F000 \SystemRoot\system32\DRIVERS\flpydisk.sys
0xF7B39000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xECA73000 \SystemRoot\System32\Drivers\Null.SYS
0xF7B3B000 \SystemRoot\System32\Drivers\Beep.SYS
0xF233B000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0xF232B000 \SystemRoot\System32\drivers\vga.sys
0xF7B3D000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xF7B3F000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xECE39000 \SystemRoot\System32\Drivers\Msfs.SYS
0xECE31000 \SystemRoot\System32\Drivers\Npfs.SYS
0xECC02000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xB2FCD000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xB2F74000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xB2F4E000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xB2F35000 \SystemRoot\System32\Drivers\avgtdix.sys
0xECADD000 \SystemRoot\system32\DRIVERS\wanarp.sys
0xB2F0D000 \SystemRoot\system32\DRIVERS\netbt.sys
0xB2EEB000 \SystemRoot\System32\drivers\afd.sys
0xECACD000 \SystemRoot\system32\DRIVERS\netbios.sys
0xECABD000 \SystemRoot\system32\DRIVERS\arp1394.sys
0xECAAD000 \SystemRoot\System32\Drivers\V2IMount.SYS
0xB2EC0000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xB2E50000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xECA9D000 \SystemRoot\System32\Drivers\Fips.SYS
0xECE29000 \SystemRoot\System32\Drivers\avgmfx86.sys
0xB2DFF000 \SystemRoot\System32\Drivers\avgldx86.sys
0xECE21000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0xF23D6000 \SystemRoot\system32\DRIVERS\hidusb.sys
0xF1FCB000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0xF23CA000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0xF23C6000 \SystemRoot\system32\DRIVERS\mouhid.sys
0xEC531000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xB2DE7000 \SystemRoot\System32\Drivers\dump_atapi.sys
0xF7B63000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xF0A0D000 \SystemRoot\System32\drivers\Dxapi.sys
0xECE09000 \SystemRoot\System32\watchdog.sys
0xBF9C4000 \SystemRoot\System32\drivers\dxg.sys
0xF7CE9000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF9D6000 \SystemRoot\System32\ati2dvag.dll
0xBFA18000 \SystemRoot\System32\ati2cqag.dll
0xBFA57000 \SystemRoot\System32\atikvmag.dll
0xBFA8D000 \SystemRoot\System32\ati3duag.dll
0xBFD11000 \SystemRoot\System32\ativvaxx.dll
0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
0xF6D85000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xB0C6A000 \SystemRoot\system32\drivers\wdmaud.sys
0xF1F8B000 \SystemRoot\system32\drivers\sysaudio.sys
0xB093F000 \SystemRoot\system32\DRIVERS\mrxdav.sys
0xF7AF3000 \SystemRoot\System32\Drivers\ParVdm.SYS
0xB0857000 \SystemRoot\System32\Drivers\Aspi32.SYS
0xB061D000 \SystemRoot\system32\DRIVERS\srv.sys
0xF1F7B000 \SystemRoot\system32\DRIVERS\secdrv.sys
0xB0404000 \SystemRoot\System32\Drivers\Fastfat.SYS
0xF78DD000 \??\C:\WINDOWS\system32\drivers\symlcbrd.sys
0xB016B000 \SystemRoot\System32\Drivers\HTTP.sys
0xAFD30000 \SystemRoot\system32\drivers\kmixer.sys
0x7C900000 \WINDOWS\system32\ntdll.dll

Processes (total 49):
0 System Idle Process
4 System
504 C:\WINDOWS\system32\smss.exe
552 csrss.exe
580 C:\WINDOWS\system32\winlogon.exe
628 C:\WINDOWS\system32\services.exe
640 C:\WINDOWS\system32\lsass.exe
816 C:\WINDOWS\system32\ati2evxx.exe
836 C:\WINDOWS\system32\svchost.exe
904 svchost.exe
976 C:\WINDOWS\system32\svchost.exe
1076 svchost.exe
1144 svchost.exe
1180 C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
1316 C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
1576 C:\WINDOWS\system32\spoolsv.exe
1680 C:\WINDOWS\explorer.exe
1928 C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
1964 C:\Program Files\Analog Devices\Core\smax4pnp.exe
196 C:\WINDOWS\system32\spool\drivers\w32x86\3\E_FATI9EA.EXE
292 C:\Program Files\Common Files\Symantec Shared\ccApp.exe
300 C:\Program Files\Norton Ghost\Agent\GhostTray.exe
324 C:\Program Files\Common Files\Java\Java Update\jusched.exe
336 C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe
344 C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
108 C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe
1600 C:\WINDOWS\system32\ctfmon.exe
1624 svchost.exe
1724 C:\Program Files\Palm\HOTSYNC.EXE
1772 C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
2072 C:\WINDOWS\system32\gearsec.exe
2180 C:\Program Files\Java\jre6\bin\jqs.exe
2228 C:\Program Files\Common Files\LightScribe\LSSrvc.exe
2428 C:\Program Files\Norton Ghost\Agent\VProSvc.exe
2460 C:\Program Files\AVG\AVG8\avgrsx.exe
2468 C:\PROGRA~1\AVG\AVG8\avgnsx.exe
2632 C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
2788 C:\WINDOWS\system32\snmp.exe
2856 C:\WINDOWS\system32\svchost.exe
2964 C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
3124 C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
3216 C:\PROGRA~1\AVG\AVG8\avgemc.exe
3236 C:\WINDOWS\system32\wuauclt.exe
3364 C:\Program Files\AVG\AVG8\avgcsrvx.exe
4084 alg.exe
2364 C:\PROGRA~1\Yahoo!\Messenger\Ymsgr_tray.exe
1252 C:\WINDOWS\system32\svchost.exe
2576 C:\WINDOWS\system32\wscntfy.exe
3232 C:\Documents and Settings\Kevin Austin\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)

PhysicalDrive0 Model Number: ST3250620AS, Rev: 3.AAC

Size Device Name MBR Status
--------------------------------------------
232 GB \\.\PhysicalDrive0 MBR Code Faked!
SHA1: 3DD27C7EE9B2D8B2CB511843C79460E5DB3CA995


Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:

Done!
 
1. Run MBRCheck.exe
2. Wait until you see the following line: Enter 'Y' and hit ENTER for more options, or 'N' to exit:
3. Please push the 'Y' key and then press Enter
4. When program ask you Enter your choice: enter 2 and press the Enter key
5. Now the program will ask you "Enter the physical disk number to fix (0-99, -1 to cancel):"
6. Enter 0 and press the Enter key.
7. The program will show Available MBR codes:, followed by a list of operating systems. Please enter 1 for Windows XP, and then press Enter.
8. The program will prompt for confirmation. Type 'YES' and hit Enter.
9. Left click on the title bar (where program name and path is written).
10. From menu chose Edit -> Select All
11. Hit the Enter key on your keyboard to copy selected text.
12. Paste that text into Notepad, save it to your desktop as "MBRCheck results.txt"
13. Restart your PC.
14. Post the text in "MBRCheck results.txt" here, please.
 
results

not sure if this is what you wanted, I think I followed your directions?

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Home Edition
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x0000001d

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)

Size Device Name MBR Status
--------------------------------------------
232 GB \\.\PhysicalDrive0 MBR Code Faked!
SHA1: 3DD27C7EE9B2D8B2CB511843C79460E5DB3CA995


Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit: y

Options:
[1] Dump the MBR of a physical disk to file.
[2] Restore the MBR of a physical disk with a standard boot code.
[3] Exit.

Enter your choice: 2

Enter the physical disk number to fix (0-99, -1 to cancel): 0
Available MBR codes:
[ 0] Default (Windows XP)
[ 1] Windows XP
[ 2] Windows Server 2003
[ 3] Windows Vista
[ 4] Windows 2008
[ 5] Windows 7
[-1] Cancel

Please select the MBR code to write to this drive: 1
Do you want to fix the MBR code? Type 'YES' and hit ENTER to continue: yes
Successfully wrote new MBR code!
Please reboot your computer to complete the fix.
 
Hi,

Just run MBRCheck like you did the first time in post 23 and post the log please, make sure you post the current one

Step 1 | Download MBRCheck.exe to your desktop.
  • Be sure to disable your security programs
  • Double click on the file to run it
  • A window will open on your desktop
  • if an unknown bootcode is found you will have further options available to you, at this time press N then press Enter twice.
  • If nothing unusual is found just press Enter
  • A .txt file named MBRCheck_mm.dd.yy_hh.mm.ss should appear on your desktop.
  • Please post the contents of that file.
 
post two parts

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Home Edition
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x0000001d

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)

Size Device Name MBR Status
--------------------------------------------
232 GB \\.\PhysicalDrive0 MBR Code Faked!
SHA1: 3DD27C7EE9B2D8B2CB511843C79460E5DB3CA995


Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit: n


Done!
Press ENTER to exit...




MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Home Edition
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x0000001d

Kernel Drivers (total 126):
0x804D7000 \WINDOWS\system32\ntoskrnl.exe
0x806FF000 \WINDOWS\system32\hal.dll
0x86E96000 \WINDOWS\system32\KDCOM.DLL
0xF79F9000 \WINDOWS\system32\BOOTVID.dll
0xF7596000 ACPI.sys
0xF7AE5000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xF7585000 pci.sys
0xF75E5000 isapnp.sys
0xF75F5000 ohci1394.sys
0xF7605000 \WINDOWS\system32\DRIVERS\1394BUS.SYS
0xF7BAD000 PCIIde.sys
0xF7865000 \WINDOWS\System32\Drivers\PCIIDEX.SYS
0xF7AE7000 intelide.sys
0xF7615000 MountMgr.sys
0xF7566000 ftdisk.sys
0xF786D000 PartMgr.sys
0xF7625000 VolSnap.sys
0xF754E000 atapi.sys
0xF7635000 disk.sys
0xF7645000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xF752E000 fltmgr.sys
0xF751C000 sr.sys
0xF7506000 SymSnap.sys
0xF74EF000 KSecDD.sys
0xF7462000 Ntfs.sys
0xF7435000 NDIS.sys
0xF741B000 Mup.sys
0xF76E5000 \SystemRoot\system32\DRIVERS\nic1394.sys
0xF7745000 \SystemRoot\system32\DRIVERS\intelppm.sys
0xF6978000 \SystemRoot\system32\DRIVERS\ati2mtag.sys
0xF6964000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xF799D000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0xF6940000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xF79A5000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xF691A000 \SystemRoot\system32\DRIVERS\e100b325.sys
0xF68DA000 \SystemRoot\system32\drivers\smwdm.sys
0xF68B6000 \SystemRoot\system32\drivers\portcls.sys
0xF7755000 \SystemRoot\system32\drivers\drmk.sys
0xF6893000 \SystemRoot\system32\drivers\ks.sys
0xF67E0000 \SystemRoot\system32\drivers\senfilt.sys
0xF79AD000 \SystemRoot\system32\DRIVERS\fdc.sys
0xF67CC000 \SystemRoot\system32\DRIVERS\parport.sys
0xF7765000 \SystemRoot\system32\DRIVERS\serial.sys
0xF7AC9000 \SystemRoot\system32\DRIVERS\serenum.sys
0xF7775000 \SystemRoot\system32\DRIVERS\imapi.sys
0xF7785000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xF7795000 \SystemRoot\system32\DRIVERS\redbook.sys
0xF79B5000 \SystemRoot\System32\Drivers\GearAspiWDM.SYS
0xF7BDD000 \SystemRoot\system32\DRIVERS\audstub.sys
0xF6E30000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xF7ADD000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xF60EB000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xF6E20000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xF6E10000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xF79ED000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xF60DA000 \SystemRoot\system32\DRIVERS\psched.sys
0xF6B85000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xF4723000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xF471B000 \SystemRoot\system32\DRIVERS\raspti.sys
0xF23C4000 \SystemRoot\system32\DRIVERS\termdd.sys
0xF4713000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xF470B000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xF7B61000 \SystemRoot\system32\DRIVERS\swenum.sys
0xF0B6B000 \SystemRoot\system32\DRIVERS\update.sys
0xF7AB9000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xF2384000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xF2374000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xF7B63000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xF4733000 \SystemRoot\system32\DRIVERS\flpydisk.sys
0xF7B49000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xAF24D000 \SystemRoot\System32\Drivers\Null.SYS
0xF7B4B000 \SystemRoot\System32\Drivers\Beep.SYS
0xF2922000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0xF291A000 \SystemRoot\System32\drivers\vga.sys
0xF7B4D000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xF7B4F000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xF2912000 \SystemRoot\System32\Drivers\Msfs.SYS
0xF290A000 \SystemRoot\System32\Drivers\Npfs.SYS
0xAF21A000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xAE6CA000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xAE671000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xAE658000 \SystemRoot\System32\Drivers\avgtdix.sys
0xAE632000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xAE60A000 \SystemRoot\system32\DRIVERS\netbt.sys
0xAEFFC000 \SystemRoot\system32\DRIVERS\wanarp.sys
0xAE5E8000 \SystemRoot\System32\drivers\afd.sys
0xAEFEC000 \SystemRoot\system32\DRIVERS\netbios.sys
0xAEFDC000 \SystemRoot\System32\Drivers\V2IMount.SYS
0xAE5BD000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xAEFCC000 \SystemRoot\system32\DRIVERS\arp1394.sys
0xAE54D000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xAEFBC000 \SystemRoot\System32\Drivers\Fips.SYS
0xF2902000 \SystemRoot\System32\Drivers\avgmfx86.sys
0xAE4FC000 \SystemRoot\System32\Drivers\avgldx86.sys
0xF28FA000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0xF7ABD000 \SystemRoot\system32\DRIVERS\hidusb.sys
0xF47C3000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0xF1E22000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0xF1E1E000 \SystemRoot\system32\DRIVERS\mouhid.sys
0xB26F6000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xAE4E4000 \SystemRoot\System32\Drivers\dump_atapi.sys
0xAF26C000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xF73D6000 \SystemRoot\System32\drivers\Dxapi.sys
0xAF30D000 \SystemRoot\System32\watchdog.sys
0xBF9C4000 \SystemRoot\System32\drivers\dxg.sys
0xF7BC5000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF9D6000 \SystemRoot\System32\ati2dvag.dll
0xBFA18000 \SystemRoot\System32\ati2cqag.dll
0xBFA57000 \SystemRoot\System32\atikvmag.dll
0xBFA8D000 \SystemRoot\System32\ati3duag.dll
0xBFD11000 \SystemRoot\System32\ativvaxx.dll
0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
0xF7A91000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xAC38F000 \SystemRoot\system32\drivers\wdmaud.sys
0xF7805000 \SystemRoot\system32\drivers\sysaudio.sys
0xAC36B000 \SystemRoot\System32\Drivers\Fastfat.SYS
0xAC0B8000 \SystemRoot\system32\DRIVERS\mrxdav.sys
0xAE7AA000 \SystemRoot\System32\Drivers\ParVdm.SYS
0xAC400000 \SystemRoot\System32\Drivers\Aspi32.SYS
0xABDE6000 \SystemRoot\system32\DRIVERS\srv.sys
0xAC215000 \SystemRoot\system32\DRIVERS\secdrv.sys
0xF7915000 \??\C:\WINDOWS\system32\drivers\symlcbrd.sys
0xAB498000 \SystemRoot\System32\Drivers\HTTP.sys
0xAB0AD000 \SystemRoot\system32\drivers\kmixer.sys
0x7C900000 \WINDOWS\system32\ntdll.dll

Processes (total 47):
0 System Idle Process
4 System
468 C:\WINDOWS\system32\smss.exe
516 csrss.exe
544 C:\WINDOWS\system32\winlogon.exe
596 C:\WINDOWS\system32\services.exe
608 C:\WINDOWS\system32\lsass.exe
780 C:\WINDOWS\system32\ati2evxx.exe
800 C:\WINDOWS\system32\svchost.exe
864 svchost.exe
936 C:\WINDOWS\system32\svchost.exe
1092 svchost.exe
1288 svchost.exe
1344 C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
1436 C:\WINDOWS\explorer.exe
1444 C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
1648 C:\WINDOWS\system32\spoolsv.exe
2032 C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
2040 C:\Program Files\Analog Devices\Core\smax4pnp.exe
168 C:\WINDOWS\system32\spool\drivers\w32x86\3\E_FATI9EA.EXE
280 C:\Program Files\Common Files\Symantec Shared\ccApp.exe
436 C:\Program Files\Norton Ghost\Agent\GhostTray.exe
236 C:\Program Files\Common Files\Java\Java Update\jusched.exe
512 C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
924 svchost.exe
972 C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe
1156 C:\WINDOWS\system32\ctfmon.exe
1272 C:\Program Files\Palm\HOTSYNC.EXE
1696 C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
948 C:\WINDOWS\system32\gearsec.exe
1944 C:\Program Files\Java\jre6\bin\jqs.exe
2060 C:\Program Files\Common Files\LightScribe\LSSrvc.exe
2272 C:\Program Files\Norton Ghost\Agent\VProSvc.exe
2356 C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
2384 C:\Program Files\AVG\AVG8\avgrsx.exe
2608 C:\WINDOWS\system32\snmp.exe
2672 C:\WINDOWS\system32\svchost.exe
2764 C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
2976 C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
3048 C:\PROGRA~1\AVG\AVG8\avgemc.exe
3176 C:\Program Files\AVG\AVG8\avgcsrvx.exe
3840 alg.exe
2128 C:\PROGRA~1\Yahoo!\Messenger\Ymsgr_tray.exe
1868 C:\WINDOWS\system32\svchost.exe
3464 C:\PROGRA~1\AVG\AVG8\avgnsx.exe
1380 C:\WINDOWS\system32\wscntfy.exe
2924 C:\Documents and Settings\Kevin Austin\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)

PhysicalDrive0 Model Number: ST3250620AS, Rev: 3.AAC

Size Device Name MBR Status
--------------------------------------------
232 GB \\.\PhysicalDrive0 MBR Code Faked!
SHA1: 3DD27C7EE9B2D8B2CB511843C79460E5DB3CA995


Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:

Done!
 
Looks like your Master Boot Record is infected and MBRCheck did not fix it, let me look into this and be back in a bit

In the meantime run this program and post the log please, it may determine our next move


  • Download TDSSKiller and save it to your Desktop.

Extract the file and run it.

Once completed it will create a log in your C:\ drive called TDSSKiller_* (* denotes version & date)

Please post the content of the TDSSKiller log
 
If you have not run TDSS killer yet, hold off on it a bit and do this first

Double click on MBRCheck.exe to run it,
  • type in Y and press Enter when asked if you wish to see more options
  • Type in 1 to "Dump the MBR of a physical disk to file" and press Enter
  • Type in 0 to select your disk and press Enter
  • Type in dump.txt as the file name and press Enter
  • Type in -1 to exit and press Enter.
Please attach dump.txt to your next reply for me.
 
OK, thanks, I am having a MBR expert look at this and will post instructions when they get back to me, so sit tight and dont go away
 
log

attached screen shot of what it found, do i need to cure, skip, etc...



2010/10/24 19:07:34.0062 TDSS rootkit removing tool 2.4.4.0 Oct 4 2010 09:06:59
2010/10/24 19:07:34.0062 ================================================================================
2010/10/24 19:07:34.0062 SystemInfo:
2010/10/24 19:07:34.0062
2010/10/24 19:07:34.0062 OS Version: 5.1.2600 ServicePack: 3.0
2010/10/24 19:07:34.0062 Product type: Workstation
2010/10/24 19:07:34.0062 ComputerName: KEVIN-HOME
2010/10/24 19:07:34.0062 UserName: Kevin Austin
2010/10/24 19:07:34.0062 Windows directory: C:\WINDOWS
2010/10/24 19:07:34.0062 System windows directory: C:\WINDOWS
2010/10/24 19:07:34.0062 Processor architecture: Intel x86
2010/10/24 19:07:34.0062 Number of processors: 2
2010/10/24 19:07:34.0062 Page size: 0x1000
2010/10/24 19:07:34.0062 Boot type: Normal boot
2010/10/24 19:07:34.0062 ================================================================================
2010/10/24 19:07:34.0265 Initialize success
2010/10/24 19:07:58.0156 ================================================================================
2010/10/24 19:07:58.0156 Scan started
2010/10/24 19:07:58.0156 Mode: Manual;
2010/10/24 19:07:58.0156 ================================================================================
2010/10/24 19:07:58.0406 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
2010/10/24 19:07:58.0468 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
2010/10/24 19:07:58.0546 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
2010/10/24 19:07:58.0578 AFD (7e775010ef291da96ad17ca4b17137d7) C:\WINDOWS\System32\drivers\afd.sys
2010/10/24 19:07:58.0781 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
2010/10/24 19:07:59.0000 Aspi32 (ed8cee58c1e4c5893f5b2fd686a272bf) C:\WINDOWS\system32\drivers\Aspi32.sys
2010/10/24 19:07:59.0031 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
2010/10/24 19:07:59.0125 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
2010/10/24 19:07:59.0218 ati2mtag (a7dd7088e2c987dbcb3f4d6d56f723bd) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys
2010/10/24 19:07:59.0281 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
2010/10/24 19:07:59.0343 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
2010/10/24 19:07:59.0406 AvgLdx86 (bc12f2404bb6f2b6b2ff3c4c246cb752) C:\WINDOWS\System32\Drivers\avgldx86.sys
2010/10/24 19:07:59.0453 AvgMfx86 (5903d729d4f0c5bca74123c96a1b29e0) C:\WINDOWS\System32\Drivers\avgmfx86.sys
2010/10/24 19:07:59.0468 AvgTdiX (92d8e1e8502e649b60e70074eb29c380) C:\WINDOWS\System32\Drivers\avgtdix.sys
2010/10/24 19:07:59.0515 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
2010/10/24 19:07:59.0734 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
2010/10/24 19:07:59.0828 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
2010/10/24 19:07:59.0937 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
2010/10/24 19:07:59.0984 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
2010/10/24 19:08:00.0281 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
2010/10/24 19:08:00.0390 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
2010/10/24 19:08:00.0500 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys
2010/10/24 19:08:00.0546 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
2010/10/24 19:08:00.0593 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
2010/10/24 19:08:00.0656 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
2010/10/24 19:08:00.0718 E100B (7d91dc6342248369f94d6eba0cf42e99) C:\WINDOWS\system32\DRIVERS\e100b325.sys
2010/10/24 19:08:00.0781 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
2010/10/24 19:08:00.0843 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
2010/10/24 19:08:00.0921 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
2010/10/24 19:08:00.0968 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
2010/10/24 19:08:01.0015 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
2010/10/24 19:08:01.0078 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
2010/10/24 19:08:01.0125 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
2010/10/24 19:08:01.0187 GearAspiWDM (32a73a8952580b284a47290adb62032a) C:\WINDOWS\system32\drivers\GearAspiWDM.sys
2010/10/24 19:08:01.0250 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
2010/10/24 19:08:01.0312 hidusb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
2010/10/24 19:08:01.0421 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
2010/10/24 19:08:01.0500 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
2010/10/24 19:08:01.0687 IntelC51 (fcab28ffd3a8964581e16455efaf81c8) C:\WINDOWS\system32\DRIVERS\IntelC51.sys
2010/10/24 19:08:01.0734 IntelC52 (a288e7e3a6255255b9066686d860fbc5) C:\WINDOWS\system32\DRIVERS\IntelC52.sys
2010/10/24 19:08:01.0796 IntelC53 (d5e5a1abf6bdba7ca49941a044f04598) C:\WINDOWS\system32\DRIVERS\IntelC53.sys
2010/10/24 19:08:01.0828 IntelIde (b5466a9250342a7aa0cd1fba13420678) C:\WINDOWS\system32\DRIVERS\intelide.sys
2010/10/24 19:08:01.0843 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys
2010/10/24 19:08:01.0906 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
2010/10/24 19:08:01.0968 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2010/10/24 19:08:02.0000 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
2010/10/24 19:08:02.0046 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
2010/10/24 19:08:02.0078 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
2010/10/24 19:08:02.0125 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
2010/10/24 19:08:02.0156 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
2010/10/24 19:08:02.0203 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
2010/10/24 19:08:02.0218 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
2010/10/24 19:08:02.0265 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
2010/10/24 19:08:02.0281 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
2010/10/24 19:08:02.0390 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
2010/10/24 19:08:02.0453 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
2010/10/24 19:08:02.0500 MODEMCSA (1992e0d143b09653ab0f9c5e04b0fd65) C:\WINDOWS\system32\drivers\MODEMCSA.sys
2010/10/24 19:08:02.0578 mohfilt (c6a08c4f34b3048a73bbb2951150f98d) C:\WINDOWS\system32\DRIVERS\mohfilt.sys
2010/10/24 19:08:02.0609 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
2010/10/24 19:08:02.0671 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
2010/10/24 19:08:02.0703 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
2010/10/24 19:08:02.0750 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
2010/10/24 19:08:02.0781 MRxSmb (60ae98742484e7ab80c3c1450e708148) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
2010/10/24 19:08:02.0859 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
2010/10/24 19:08:02.0937 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
2010/10/24 19:08:02.0984 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2010/10/24 19:08:03.0015 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
2010/10/24 19:08:03.0062 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
2010/10/24 19:08:03.0093 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys
2010/10/24 19:08:03.0171 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
2010/10/24 19:08:03.0203 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
2010/10/24 19:08:03.0234 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
2010/10/24 19:08:03.0265 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
2010/10/24 19:08:03.0312 NDProxy (6215023940cfd3702b46abc304e1d45a) C:\WINDOWS\system32\drivers\NDProxy.sys
2010/10/24 19:08:03.0359 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
2010/10/24 19:08:03.0406 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
2010/10/24 19:08:03.0484 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
2010/10/24 19:08:03.0515 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
2010/10/24 19:08:03.0562 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
2010/10/24 19:08:03.0656 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
2010/10/24 19:08:03.0734 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2010/10/24 19:08:03.0765 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2010/10/24 19:08:03.0812 ohci1394 (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
2010/10/24 19:08:03.0859 PalmUSBD (945da25e897eeb2c64861c3cada00d3a) C:\WINDOWS\system32\drivers\PalmUSBD.sys
2010/10/24 19:08:03.0906 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys
2010/10/24 19:08:03.0953 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
2010/10/24 19:08:04.0031 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
2010/10/24 19:08:04.0062 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys
2010/10/24 19:08:04.0125 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\drivers\PCIIde.sys
2010/10/24 19:08:04.0156 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys
2010/10/24 19:08:04.0500 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
2010/10/24 19:08:04.0546 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
2010/10/24 19:08:04.0640 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
2010/10/24 19:08:04.0843 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
2010/10/24 19:08:04.0875 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2010/10/24 19:08:04.0921 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
2010/10/24 19:08:04.0937 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
2010/10/24 19:08:05.0000 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
2010/10/24 19:08:05.0046 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2010/10/24 19:08:05.0109 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys
2010/10/24 19:08:05.0171 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
2010/10/24 19:08:05.0265 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
2010/10/24 19:08:05.0343 senfilt (b9c7617c1e8ab6fdff75d3c8dafcb4c8) C:\WINDOWS\system32\drivers\senfilt.sys
2010/10/24 19:08:05.0390 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
2010/10/24 19:08:05.0437 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys
2010/10/24 19:08:05.0484 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
2010/10/24 19:08:05.0609 smwdm (c6d9959e493682f872a639b6ec1b4a08) C:\WINDOWS\system32\drivers\smwdm.sys
2010/10/24 19:08:05.0671 SONYPVU1 (a1eceeaa5c5e74b2499eb51d38185b84) C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS
2010/10/24 19:08:05.0765 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
2010/10/24 19:08:05.0843 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
2010/10/24 19:08:05.0906 Srv (3bb03f2ba89d2be417206c373d2af17c) C:\WINDOWS\system32\DRIVERS\srv.sys
2010/10/24 19:08:06.0015 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
2010/10/24 19:08:06.0046 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
2010/10/24 19:08:06.0187 symlcbrd (5220576ee29bea7c18dff9ecabf18bbc) C:\WINDOWS\system32\drivers\symlcbrd.sys
2010/10/24 19:08:06.0218 SymSnap (fea2d66aeb341e11fad6ff2d50b8ca40) C:\WINDOWS\system32\drivers\SymSnap.sys
2010/10/24 19:08:06.0296 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
2010/10/24 19:08:06.0343 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
2010/10/24 19:08:06.0406 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
2010/10/24 19:08:06.0453 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
2010/10/24 19:08:06.0484 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
2010/10/24 19:08:06.0578 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
2010/10/24 19:08:06.0671 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
2010/10/24 19:08:06.0718 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
2010/10/24 19:08:06.0765 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
2010/10/24 19:08:06.0781 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
2010/10/24 19:08:06.0828 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
2010/10/24 19:08:06.0875 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
2010/10/24 19:08:06.0906 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2010/10/24 19:08:06.0953 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
2010/10/24 19:08:07.0000 V2IMount (deea641cc5f87867759856a52cbc0999) C:\WINDOWS\system32\drivers\V2IMount.sys
2010/10/24 19:08:07.0046 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
2010/10/24 19:08:07.0093 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
2010/10/24 19:08:07.0156 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
2010/10/24 19:08:07.0250 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
2010/10/24 19:08:07.0390 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
2010/10/24 19:08:07.0453 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
2010/10/24 19:08:07.0515 \HardDisk0\MBR - detected Rootkit.Win32.TDSS.tdl4 (0)
2010/10/24 19:08:07.0515 ================================================================================
2010/10/24 19:08:07.0515 Scan finished
2010/10/24 19:08:07.0515 ================================================================================
2010/10/24 19:08:07.0531 Detected object count: 1
2010/10/24 19:13:16.0546 Rootkit.Win32.TDSS.tdl4(\HardDisk0\MBR) - User select action: Skip
2010/10/24 19:13:48.0031 Deinitialize success
 
All us forums work together with some forums specializing in different areas of infections so I have other people looking at this also. It looks like the TDSS Rootkit has infected your Master Boot Record and this is something we want to handle very delicately so just hang on a bit and lets see what they say
 
Go ahead and run TDSSKiller again and this time have it cure it. Post the log, then run MBRCheck again and post the NEW LOG
 
TDS and MBR log

2010/10/25 19:02:55.0031 TDSS rootkit removing tool 2.4.4.0 Oct 4 2010 09:06:59
2010/10/25 19:02:55.0031 ================================================================================
2010/10/25 19:02:55.0031 SystemInfo:
2010/10/25 19:02:55.0031
2010/10/25 19:02:55.0031 OS Version: 5.1.2600 ServicePack: 3.0
2010/10/25 19:02:55.0031 Product type: Workstation
2010/10/25 19:02:55.0031 ComputerName: KEVIN-HOME
2010/10/25 19:02:55.0031 UserName: Kevin Austin
2010/10/25 19:02:55.0031 Windows directory: C:\WINDOWS
2010/10/25 19:02:55.0031 System windows directory: C:\WINDOWS
2010/10/25 19:02:55.0031 Processor architecture: Intel x86
2010/10/25 19:02:55.0031 Number of processors: 2
2010/10/25 19:02:55.0031 Page size: 0x1000
2010/10/25 19:02:55.0031 Boot type: Normal boot
2010/10/25 19:02:55.0031 ================================================================================
2010/10/25 19:02:55.0562 Initialize success
2010/10/25 19:02:58.0750 ================================================================================
2010/10/25 19:02:58.0750 Scan started
2010/10/25 19:02:58.0750 Mode: Manual;
2010/10/25 19:02:58.0750 ================================================================================
2010/10/25 19:03:00.0296 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
2010/10/25 19:03:00.0406 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
2010/10/25 19:03:00.0500 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
2010/10/25 19:03:00.0531 AFD (7e775010ef291da96ad17ca4b17137d7) C:\WINDOWS\System32\drivers\afd.sys
2010/10/25 19:03:00.0843 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
2010/10/25 19:03:01.0078 Aspi32 (ed8cee58c1e4c5893f5b2fd686a272bf) C:\WINDOWS\system32\drivers\Aspi32.sys
2010/10/25 19:03:01.0125 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
2010/10/25 19:03:01.0171 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
2010/10/25 19:03:01.0343 ati2mtag (a7dd7088e2c987dbcb3f4d6d56f723bd) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys
2010/10/25 19:03:01.0437 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
2010/10/25 19:03:01.0531 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
2010/10/25 19:03:01.0656 AvgLdx86 (bc12f2404bb6f2b6b2ff3c4c246cb752) C:\WINDOWS\System32\Drivers\avgldx86.sys
2010/10/25 19:03:01.0703 AvgMfx86 (5903d729d4f0c5bca74123c96a1b29e0) C:\WINDOWS\System32\Drivers\avgmfx86.sys
2010/10/25 19:03:01.0750 AvgTdiX (92d8e1e8502e649b60e70074eb29c380) C:\WINDOWS\System32\Drivers\avgtdix.sys
2010/10/25 19:03:01.0796 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
2010/10/25 19:03:02.0000 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
2010/10/25 19:03:02.0109 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
2010/10/25 19:03:02.0203 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
2010/10/25 19:03:02.0265 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
2010/10/25 19:03:02.0515 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
2010/10/25 19:03:02.0640 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
2010/10/25 19:03:02.0734 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys
2010/10/25 19:03:02.0796 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
2010/10/25 19:03:02.0859 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
2010/10/25 19:03:02.0906 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
2010/10/25 19:03:02.0953 E100B (7d91dc6342248369f94d6eba0cf42e99) C:\WINDOWS\system32\DRIVERS\e100b325.sys
2010/10/25 19:03:03.0046 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
2010/10/25 19:03:03.0093 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
2010/10/25 19:03:03.0156 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
2010/10/25 19:03:03.0187 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
2010/10/25 19:03:03.0265 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
2010/10/25 19:03:03.0375 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
2010/10/25 19:03:03.0406 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
2010/10/25 19:03:03.0453 GearAspiWDM (32a73a8952580b284a47290adb62032a) C:\WINDOWS\system32\drivers\GearAspiWDM.sys
2010/10/25 19:03:03.0515 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
2010/10/25 19:03:03.0578 hidusb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
2010/10/25 19:03:03.0734 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
2010/10/25 19:03:03.0843 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
2010/10/25 19:03:04.0062 IntelC51 (fcab28ffd3a8964581e16455efaf81c8) C:\WINDOWS\system32\DRIVERS\IntelC51.sys
2010/10/25 19:03:04.0312 IntelC52 (a288e7e3a6255255b9066686d860fbc5) C:\WINDOWS\system32\DRIVERS\IntelC52.sys
2010/10/25 19:03:04.0406 IntelC53 (d5e5a1abf6bdba7ca49941a044f04598) C:\WINDOWS\system32\DRIVERS\IntelC53.sys
2010/10/25 19:03:04.0453 IntelIde (b5466a9250342a7aa0cd1fba13420678) C:\WINDOWS\system32\DRIVERS\intelide.sys
2010/10/25 19:03:04.0500 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys
2010/10/25 19:03:04.0593 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
2010/10/25 19:03:04.0656 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2010/10/25 19:03:04.0718 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
2010/10/25 19:03:04.0765 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
2010/10/25 19:03:04.0828 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
2010/10/25 19:03:04.0890 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
2010/10/25 19:03:04.0937 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
2010/10/25 19:03:05.0000 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
2010/10/25 19:03:05.0046 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
2010/10/25 19:03:05.0109 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
2010/10/25 19:03:05.0125 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
2010/10/25 19:03:05.0265 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
2010/10/25 19:03:05.0328 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
2010/10/25 19:03:05.0406 MODEMCSA (1992e0d143b09653ab0f9c5e04b0fd65) C:\WINDOWS\system32\drivers\MODEMCSA.sys
2010/10/25 19:03:05.0468 mohfilt (c6a08c4f34b3048a73bbb2951150f98d) C:\WINDOWS\system32\DRIVERS\mohfilt.sys
2010/10/25 19:03:05.0515 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
2010/10/25 19:03:05.0609 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
2010/10/25 19:03:05.0656 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
2010/10/25 19:03:05.0718 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
2010/10/25 19:03:05.0765 MRxSmb (60ae98742484e7ab80c3c1450e708148) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
2010/10/25 19:03:05.0859 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
2010/10/25 19:03:05.0937 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
2010/10/25 19:03:05.0984 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2010/10/25 19:03:06.0031 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
2010/10/25 19:03:06.0093 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
2010/10/25 19:03:06.0187 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys
2010/10/25 19:03:06.0281 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
2010/10/25 19:03:06.0343 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
2010/10/25 19:03:06.0390 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
2010/10/25 19:03:06.0406 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
2010/10/25 19:03:06.0437 NDProxy (6215023940cfd3702b46abc304e1d45a) C:\WINDOWS\system32\drivers\NDProxy.sys
2010/10/25 19:03:06.0515 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
2010/10/25 19:03:06.0562 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
2010/10/25 19:03:06.0656 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
2010/10/25 19:03:06.0734 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
2010/10/25 19:03:06.0781 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
2010/10/25 19:03:06.0890 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
2010/10/25 19:03:06.0937 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2010/10/25 19:03:06.0968 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2010/10/25 19:03:07.0046 ohci1394 (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
2010/10/25 19:03:07.0140 PalmUSBD (945da25e897eeb2c64861c3cada00d3a) C:\WINDOWS\system32\drivers\PalmUSBD.sys
2010/10/25 19:03:07.0234 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys
2010/10/25 19:03:07.0296 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
2010/10/25 19:03:07.0375 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
2010/10/25 19:03:07.0406 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys
2010/10/25 19:03:07.0484 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\drivers\PCIIde.sys
2010/10/25 19:03:07.0546 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys
2010/10/25 19:03:07.0859 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
2010/10/25 19:03:07.0890 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
2010/10/25 19:03:07.0953 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
2010/10/25 19:03:08.0234 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
2010/10/25 19:03:08.0281 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2010/10/25 19:03:08.0328 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
2010/10/25 19:03:08.0375 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
2010/10/25 19:03:08.0453 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
2010/10/25 19:03:08.0500 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2010/10/25 19:03:08.0578 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys
2010/10/25 19:03:08.0640 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
2010/10/25 19:03:08.0734 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
2010/10/25 19:03:08.0828 senfilt (b9c7617c1e8ab6fdff75d3c8dafcb4c8) C:\WINDOWS\system32\drivers\senfilt.sys
2010/10/25 19:03:08.0875 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
2010/10/25 19:03:08.0937 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys
2010/10/25 19:03:09.0015 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
2010/10/25 19:03:09.0296 smwdm (c6d9959e493682f872a639b6ec1b4a08) C:\WINDOWS\system32\drivers\smwdm.sys
2010/10/25 19:03:09.0437 SONYPVU1 (a1eceeaa5c5e74b2499eb51d38185b84) C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS
2010/10/25 19:03:09.0546 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
2010/10/25 19:03:09.0593 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
2010/10/25 19:03:09.0687 Srv (3bb03f2ba89d2be417206c373d2af17c) C:\WINDOWS\system32\DRIVERS\srv.sys
2010/10/25 19:03:09.0812 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
2010/10/25 19:03:09.0843 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
2010/10/25 19:03:09.0984 symlcbrd (5220576ee29bea7c18dff9ecabf18bbc) C:\WINDOWS\system32\drivers\symlcbrd.sys
2010/10/25 19:03:10.0031 SymSnap (fea2d66aeb341e11fad6ff2d50b8ca40) C:\WINDOWS\system32\drivers\SymSnap.sys
2010/10/25 19:03:10.0187 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
2010/10/25 19:03:10.0296 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
2010/10/25 19:03:10.0390 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
2010/10/25 19:03:10.0437 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
2010/10/25 19:03:10.0484 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
2010/10/25 19:03:10.0593 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
2010/10/25 19:03:10.0718 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
2010/10/25 19:03:10.0796 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
2010/10/25 19:03:10.0859 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
2010/10/25 19:03:10.0921 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
2010/10/25 19:03:10.0984 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
2010/10/25 19:03:11.0078 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
2010/10/25 19:03:11.0125 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2010/10/25 19:03:11.0171 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
2010/10/25 19:03:11.0218 V2IMount (deea641cc5f87867759856a52cbc0999) C:\WINDOWS\system32\drivers\V2IMount.sys
2010/10/25 19:03:11.0281 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
2010/10/25 19:03:11.0359 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
2010/10/25 19:03:11.0406 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
2010/10/25 19:03:11.0500 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
2010/10/25 19:03:11.0640 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
2010/10/25 19:03:11.0718 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
2010/10/25 19:03:11.0812 \HardDisk0\MBR - detected Rootkit.Win32.TDSS.tdl4 (0)
2010/10/25 19:03:11.0812 ================================================================================
2010/10/25 19:03:11.0812 Scan finished
2010/10/25 19:03:11.0812 ================================================================================
2010/10/25 19:03:11.0828 Detected object count: 1
2010/10/25 19:03:16.0078 \HardDisk0\MBR - will be cured after reboot
2010/10/25 19:03:16.0078 Rootkit.Win32.TDSS.tdl4(\HardDisk0\MBR) - User select action: Cure
2010/10/25 19:03:22.0625 Deinitialize success




MBR**********************************

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Home Edition
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x0000001d

Kernel Drivers (total 125):
0x804D7000 \WINDOWS\system32\ntoskrnl.exe
0x806FF000 \WINDOWS\system32\hal.dll
0xF7AE5000 \WINDOWS\system32\KDCOM.DLL
0xF79F5000 \WINDOWS\system32\BOOTVID.dll
0xF7596000 ACPI.sys
0xF7AE7000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xF7585000 pci.sys
0xF75E5000 isapnp.sys
0xF75F5000 ohci1394.sys
0xF7605000 \WINDOWS\system32\DRIVERS\1394BUS.SYS
0xF7BAD000 PCIIde.sys
0xF7865000 \WINDOWS\System32\Drivers\PCIIDEX.SYS
0xF7AE9000 intelide.sys
0xF7615000 MountMgr.sys
0xF7566000 ftdisk.sys
0xF786D000 PartMgr.sys
0xF7625000 VolSnap.sys
0xF754E000 atapi.sys
0xF7635000 disk.sys
0xF7645000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xF752E000 fltmgr.sys
0xF751C000 sr.sys
0xF7506000 SymSnap.sys
0xF74EF000 KSecDD.sys
0xF7462000 Ntfs.sys
0xF7435000 NDIS.sys
0xF741B000 Mup.sys
0xF76D5000 \SystemRoot\system32\DRIVERS\nic1394.sys
0xF7785000 \SystemRoot\system32\DRIVERS\intelppm.sys
0xF7245000 \SystemRoot\system32\DRIVERS\ati2mtag.sys
0xF7231000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xF78DD000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0xF720D000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xF78E5000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xF71E7000 \SystemRoot\system32\DRIVERS\e100b325.sys
0xF71A7000 \SystemRoot\system32\drivers\smwdm.sys
0xF7183000 \SystemRoot\system32\drivers\portcls.sys
0xF7795000 \SystemRoot\system32\drivers\drmk.sys
0xF7160000 \SystemRoot\system32\drivers\ks.sys
0xF70AD000 \SystemRoot\system32\drivers\senfilt.sys
0xF78ED000 \SystemRoot\system32\DRIVERS\fdc.sys
0xF7099000 \SystemRoot\system32\DRIVERS\parport.sys
0xF77A5000 \SystemRoot\system32\DRIVERS\serial.sys
0xF7A99000 \SystemRoot\system32\DRIVERS\serenum.sys
0xF77B5000 \SystemRoot\system32\DRIVERS\imapi.sys
0xF77C5000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xF77D5000 \SystemRoot\system32\DRIVERS\redbook.sys
0xF78F5000 \SystemRoot\System32\Drivers\GearAspiWDM.SYS
0xF7BC5000 \SystemRoot\system32\DRIVERS\audstub.sys
0xF77E5000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xF7AA5000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xF703D000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xF77F5000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xF7805000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xF78FD000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xF702C000 \SystemRoot\system32\DRIVERS\psched.sys
0xF7815000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xF7905000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xF790D000 \SystemRoot\system32\DRIVERS\raspti.sys
0xF7825000 \SystemRoot\system32\DRIVERS\termdd.sys
0xF7915000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xF791D000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xF7B07000 \SystemRoot\system32\DRIVERS\swenum.sys
0xF6FCE000 \SystemRoot\system32\DRIVERS\update.sys
0xF7AB1000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xF7855000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xF7665000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xF7B09000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xF7925000 \SystemRoot\system32\DRIVERS\flpydisk.sys
0xF7B0D000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xF7CE5000 \SystemRoot\System32\Drivers\Null.SYS
0xF7B0F000 \SystemRoot\System32\Drivers\Beep.SYS
0xF7935000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0xF793D000 \SystemRoot\System32\drivers\vga.sys
0xF7B11000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xF7B13000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xF7945000 \SystemRoot\System32\Drivers\Msfs.SYS
0xF794D000 \SystemRoot\System32\Drivers\Npfs.SYS
0xF73E6000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xEEE8B000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xEEE32000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xEEE19000 \SystemRoot\System32\Drivers\avgtdix.sys
0xEEDF3000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xEEDCB000 \SystemRoot\system32\DRIVERS\netbt.sys
0xF7685000 \SystemRoot\system32\DRIVERS\wanarp.sys
0xEEDA9000 \SystemRoot\System32\drivers\afd.sys
0xF7695000 \SystemRoot\system32\DRIVERS\netbios.sys
0xF76A5000 \SystemRoot\System32\Drivers\V2IMount.SYS
0xEED2E000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xF76B5000 \SystemRoot\system32\DRIVERS\arp1394.sys
0xEECBE000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xF76C5000 \SystemRoot\System32\Drivers\Fips.SYS
0xF7955000 \SystemRoot\System32\Drivers\avgmfx86.sys
0xEEC6D000 \SystemRoot\System32\Drivers\avgldx86.sys
0xF795D000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0xF7ADD000 \SystemRoot\system32\DRIVERS\hidusb.sys
0xF76E5000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0xEEEC2000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0xEEEBE000 \SystemRoot\system32\DRIVERS\mouhid.sys
0xF7715000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xEEB8D000 \SystemRoot\System32\Drivers\dump_atapi.sys
0xF7B15000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xEEEA2000 \SystemRoot\System32\drivers\Dxapi.sys
0xF7965000 \SystemRoot\System32\watchdog.sys
0xBF9C4000 \SystemRoot\System32\drivers\dxg.sys
0xF7D20000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF9D6000 \SystemRoot\System32\ati2dvag.dll
0xBFA18000 \SystemRoot\System32\ati2cqag.dll
0xBFA57000 \SystemRoot\System32\atikvmag.dll
0xBFA8D000 \SystemRoot\System32\ati3duag.dll
0xBFD11000 \SystemRoot\System32\ativvaxx.dll
0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
0xB8EEC000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xB8AC3000 \SystemRoot\system32\drivers\wdmaud.sys
0xB8C10000 \SystemRoot\system32\drivers\sysaudio.sys
0xB88D8000 \SystemRoot\system32\DRIVERS\mrxdav.sys
0xF7B93000 \SystemRoot\System32\Drivers\ParVdm.SYS
0xB88C0000 \SystemRoot\System32\Drivers\Aspi32.SYS
0xB8606000 \SystemRoot\system32\DRIVERS\srv.sys
0xB8BE0000 \SystemRoot\system32\DRIVERS\secdrv.sys
0xB824A000 \SystemRoot\System32\Drivers\Fastfat.SYS
0xF78C5000 \??\C:\WINDOWS\system32\drivers\symlcbrd.sys
0xB7F89000 \SystemRoot\System32\Drivers\HTTP.sys
0x7C900000 \WINDOWS\system32\ntdll.dll

Processes (total 47):
0 System Idle Process
4 System
468 C:\WINDOWS\system32\smss.exe
516 csrss.exe
544 C:\WINDOWS\system32\winlogon.exe
592 C:\WINDOWS\system32\services.exe
604 C:\WINDOWS\system32\lsass.exe
764 C:\WINDOWS\system32\ati2evxx.exe
784 C:\WINDOWS\system32\svchost.exe
848 svchost.exe
920 C:\WINDOWS\system32\svchost.exe
984 svchost.exe
1064 svchost.exe
1108 C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
1140 C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
1424 C:\WINDOWS\system32\spoolsv.exe
1600 C:\WINDOWS\explorer.exe
312 svchost.exe
244 C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
552 C:\Program Files\Analog Devices\Core\smax4pnp.exe
652 C:\PROGRA~1\AVG\AVG8\avgtray.exe
896 C:\WINDOWS\system32\spool\drivers\w32x86\3\E_FATI9EA.EXE
912 C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
960 C:\Program Files\Common Files\Symantec Shared\ccApp.exe
1076 C:\Program Files\Norton Ghost\Agent\GhostTray.exe
1200 C:\WINDOWS\system32\gearsec.exe
1376 C:\Program Files\Common Files\Java\Java Update\jusched.exe
1272 C:\Program Files\Java\jre6\bin\jqs.exe
1580 C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
1644 C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe
1752 C:\Program Files\Common Files\LightScribe\LSSrvc.exe
1476 C:\WINDOWS\system32\ctfmon.exe
1156 C:\Program Files\Norton Ghost\Agent\VProSvc.exe
2064 C:\Program Files\AVG\AVG8\avgrsx.exe
2072 C:\Program Files\Palm\HOTSYNC.EXE
2092 C:\PROGRA~1\AVG\AVG8\avgnsx.exe
2256 C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
2680 C:\WINDOWS\system32\snmp.exe
2776 C:\WINDOWS\system32\svchost.exe
2820 C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
3016 C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
3076 C:\PROGRA~1\AVG\AVG8\avgemc.exe
3152 C:\Program Files\AVG\AVG8\avgcsrvx.exe
3832 alg.exe
196 C:\PROGRA~1\Yahoo!\Messenger\Ymsgr_tray.exe
1740 C:\WINDOWS\system32\svchost.exe
1828 C:\Documents and Settings\Kevin Austin\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)

PhysicalDrive0 Model Number: ST3250620AS, Rev: 3.AAC

Size Device Name MBR Status
--------------------------------------------
232 GB \\.\PhysicalDrive0 Windows XP MBR code detected
SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A


Done!
 
so far so good

well... give me another night or two, but so far thing are working well.
so what was the problem or where? have you seen it before?
if you dont have time to answer thats fine as I may not unstand any way.
I will get back with you in a couple of days and let you know how things are doing.
Thanks
 
Hi,

Years ago when I first got into this , back in the days when windows 95 first came out, kids and people with to much time on there hands wrote viruses, they at the time really did not do to much damage, more or an annoyance , but thats all changed now, Cybercriminals write this garbage, I mean gangs of criminals that are trying to steal anything they can from you , like your passwords, banking account numbers, credit card numbers, the greater majority of this scum come from off shore so its hard for the US to prosecute them. When they find away of infecting something on your system, they keep abreast of what we do, and once they learn that we can clean it they move on to something else. I don't know what you did ( opened an attachment , visited a bad website, downloaded something you should not have ) and you got infected. I had a poster similar to yours about a month ago and the fix we went through did not work , we had to rebuild his MBR though the Recovery Console, the TDSS rootkit blocked that from happening, the only recourse we had was to have the user use his Windows CD to perform the fix and he did not have one, he never posted back so dont know what he ever did , my point is that you just have to be real careful , make sure your Antivirus program is up todate and run a scan on a regular basis. We dont solicit any software programs but Malwarebytes that you downloaded and ran, the paid version has a block feature that will block you from entering bad or questionable sites, its a very inexpensive program, around $20 or so for lifetime, not a yearly fee. I have this program and keep it updated on my three systems, but this is up to you, the free version you have will still work, you can check for updates and run scans to remove bad stuff.

What happened to you is somehow you got infected with the TDSS Rootkit and that in turn infected your MBR ( Master Boot Record ) these are the files responsible for booting up your computer so every time you started your computer the infection would kick in.


You never know what these infections are capable of, I would suggest you change all your passwords for sites you frequent.

Post back in a few days and let me know how its going
 
You must log in or register to reply here.
Back
Top