Multiple Infections, Win95:CIH 1x, Win32:Nimda-O, etc, need help!

[Realm]

I'm brand-new here. Not really sure how all this works, but I really need some help and this looked like a good place to try to find it.

I ran Avast today, and it found these five items (I'm getting the info from a screen shot I took earlier of the results; I didn't think to make sure I could see what came after "block"):

Process 1480 (aawservice.exe), memory block 0x0000000002530000,block   Threat: Win95:CIH 1.x

Process 1480 (aawservice.exe), memory block 0x0000000002870000,block   Threat: Win32:Nimda-O (Drp)

Process 1480 (aawservice.exe), memory block 0x0000000002920000,block   Threat: Win32:Small-GWM (Trj)

Process 1480 (aawservice.exe), memory block 0x0000000004C80000,block   Threat: Win32:VB-EIJ (Trj)

Process 1480 (aawservice.exe), memory block 0x000000000B010000,block   Threat: Win32:Adloader-AI (Trj)

I Googled each one, and the first two really have me concerned. I immediately uninstalled Ad-Aware, so now I can't find any of the infected stuff. All the scans are coming back clean. But after what I read about the viruses, it sounds like I have a lot of Windows processes that are infected, and that uninstalling Ad-Aware isn't going to fix it. This happened to me last week and I did a manual search for each aawservice.exe file that was cited, and I had to delete them manually using FileAssassin. Avast wasn't allowing me to delete, move to chest, or anything. The "apply" button had been grayed out after this scan and after the last one.

After the first time this happened and I manually deleted the files, I reinstalled Ad-Aware, but I used the exact same installation files for the version that was infected the first time. I keep all my programs backed up to my external hard drive in case something happens to my system. I didn't think to try to download it fresh from Ad-Aware's website. So this itself was probably a mistake, and I've since deleted the program's installation files from my external.

I'm running Windows XP Media Center Edition, Service Pack 3. I'm a novice user compared to the rest of you, and I really need to know what to do about this. If completely reformatting my hard drive and starting over from scratch would be the simplest way to go (and if it'll work), then I'm willing to do that. I nearly did it this morning, but I thought asking around first would be a good way to go. In the meantime, my system seems to be running slightly better, but there's no way it's not still infected. If anyone can help, please, PLEASE let me know. Any information will be very much appreciated.

Oh, and I use Firefox. It's up to date, and as a rule I run AdBlock Plus and NoScript on it. I had NO problems whatsoever until that incident last week, and I wonder if it would be worth noting that in the past month I've added WOT, Ghostery, BetterPrivacy, BitDefender QuickScan, and Beef Taco to Firefox. I did read that a few add-ons can make Firefox less secure. Should I remove the additional add-ons and just stick with AdBlock and NoScript? I'd like to at least keep BitDefender, but I don't know if I actually need it. I use Avast, Malwarebytes, and Ad-Aware (when it's not infected by everything under the sun). Is BitDefender redundant in this case...?

[essexboy]

aawservice.exe, were you running an adaware scan at the time , or updating it ?

[DavidR]

Detections in Memory - My guess is that you are doing a Custom scan in which you have elected to scan Memory and that all these detections are in memory or are listings of files that can't be scanned. Since they aren't physical files they can't be moved to the chest, deleted, etc. so there is no action that can be taken, hence the Apply button being greyed out.

The detections in memory are frequently other security applications loading unencrypted virus signatures into memory. Having set off a scan of memory by an antivirus application looking for virus signatures, don't be too surprised if it finds some in memory.

~~~~
Personally I think you have inadvertently done the right thing in removing adaware as it simply hasn't kept pace with malware developments. But the cause was basically adaware loading unencrypted virus signatures into memory and your having initiated a scan looking for signatures in memory.