Please help me remove dmime32.dll and components

[ericl]

Hello,

I have narrowed down what seems to be the source of my issues with my pc and need help trying to remove this tricky bugger.

The first things I noticed going wrong was whenever I would go to google and click on an organic listing, I would be hijacked to another page. Even when I tried to copy and paste the link, as soon as I clicked the right mouse button, the address would change to the hijacked address...

I have tried to "shred" the file with s&d with no success. Also, I "fixed" the two files with hijackthis (sorry) to no avail.

Please assist... here is my HJT log file. Please let me know if there is anything else you may need.

Thanks so much!


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:26:10 PM, on 11/19/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Google\Update\1.2.183.13\GoogleCrashHandler.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifSvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton AntiVirus\Norton AntiVirus\Engine\16.7.2.11\ccSvcHst.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifSvc.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Norton AntiVirus\Norton AntiVirus\Engine\16.7.2.11\ccSvcHst.exe
C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\HPQ\shared\hpqwmi.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\Me\Local Settings\Application Data\Yahoo!\BrowserPlus\2.4.17\BrowserPlusCore.exe
C:\Documents and Settings\Me\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O1 - Hosts: 169.254.139.22 HP000D9D039914
O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\Snagit 9\SnagitBHO.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: CodecPlugin Class - {098716A9-0310-4CBE-BD64-B790A9761158} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton AntiVirus\Norton AntiVirus\Engine\16.7.2.11\IPSBHO.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Google Gears Helper - {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.33.0\gears.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [WatchDog] C:\Program Files\InterVideo\DVD Check\DVDCheck.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - Startup: AutorunsDisabled
O4 - Global Startup: DVD Check.lnk = C:\Program Files\InterVideo\DVD Check\DVDCheck.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Search - ?p=ZNxmk572YYUS
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.33.0\gears.dll
O9 - Extra 'Tools' menuitem: &Gears Settings - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.33.0\gears.dll
O9 - Extra button: Wild Jack Poker - {17709D14-4A02-42c6-B9FA-18C90A851F51} - C:\Microgaming\Poker\wildjackMPP\MPPoker.exe
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe
O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q105&bd=pavilion&pf=laptop
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper200711281.dll
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {8A0019EB-51FA-4AE5-A40B-C0496BBFC739} (Verizon Wireless Media Upload) - http://picture.vzw.com/activex/VerizonWirelessUploadControl.cab
O16 - DPF: {9B17FE0E-51F2-4692-8B32-8EFB805FC0E7} (HPObjectInstaller Class) - http://h30155.www3.hp.com/ediags/dd/install/guidedsolutions.cab
O16 - DPF: {A7196C8E-35A5-4FF0-9E46-E28918B5CAF6} (GameDesire Domino) - http://67.15.101.3/g_bin/eng/domino_2_0_0_32.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Register/Branding/olr3313/OCX/v1018/flashax.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O20 - AppInit_DLLs: C:\WINDOWS\System32\dmime32.dll
O20 - Winlogon Notify: 38a8ec15697 - C:\WINDOWS\System32\dmime32.dll
O20 - Winlogon Notify: __c00A2CC3 - C:\WINDOWS\system32\__c00A2CC3.dat
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Update Service (gupdate1c9d517aa5a5782) (gupdate1c9d517aa5a5782) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\shared\hpqwmi.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifSvc.exe
O23 - Service: Norton AntiVirus - Symantec Corporation - C:\Program Files\Norton AntiVirus\Norton AntiVirus\Engine\16.7.2.11\ccSvcHst.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

--
End of file - 12210 bytes

[Blade81]

Hi,


Download DDS and save it to your desktop from here (http://www.techsupportforum.com/sectools/sUBs/dds) or here (http://download.bleepingcomputer.com/sUBs/dds.scr) or here (http://www.forospyware.com/sUBs/dds).
Disable any script blocker, and then double click dds.scr to run the tool.
When done, DDS will open two (2) logs:
DDS.txt
Attach.txt

Save both reports to your desktop. Post them back to your topic.


Download GMER (http://www.gmer.net) here by clicking download exe -button and then saving it your desktop:
Double-click .exe that you downloaded
Click rootkit-tab and then scan.
Don't check
Show All
box while scanning in progress!
When scanning is ready, click Copy.
This copies log to clipboard
Post log in your reply.

[ericl]

Thanks so much for your help! I have copied the DDS file, the attach file and the GMER file below. Of course, let me know what else you may need. Thanks again Blade81!



DDS (Ver_09-09-29.01) - NTFSx86
Run by Me at 15:58:06.46 on Wed 11/25/2009
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_15
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1270.547 [GMT -6:00]

AV: Norton AntiVirus *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton AntiVirus *enabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifSvc.exe
C:\Program Files\Google\Update\1.2.183.13\GoogleCrashHandler.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton AntiVirus\Norton AntiVirus\Engine\16.7.2.11\ccSvcHst.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifSvc.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Norton AntiVirus\Norton AntiVirus\Engine\16.7.2.11\ccSvcHst.exe
C:\Program Files\HPQ\shared\hpqwmi.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\Me\Desktop\dds.com

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.yahoo.com
uSearchMigratedDefaultURL = hxxp://www.mywebsearch.com/jsp/cfg_redir2.jsp?id=ZNxmk572YYUS&fl=0&ptb=CU15EGtDfuo_BX.6DtQy9A&url=http://www.ask.com/web&q={searchTerms}&l=zn&o=sb
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
BHO: SnagIt Toolbar Loader: {00c6482d-c502-44c8-8409-fce54ad9c208} - c:\program files\techsmith\snagit 9\SnagitBHO.dll
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
BHO: {098716A9-0310-4CBE-BD64-B790A9761158} - No File
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Skype add-on (mastermind): {22bf413b-c6d2-4d91-82a9-a0f997ba588c} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: Yahoo! IE Services Button: {5bab4b5b-68bc-4b02-94d6-2fc0de4a7897} - c:\program files\yahoo!\common\yiesrvc.dll
BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\program files\norton antivirus\norton antivirus\engine\16.7.2.11\IPSBHO.DLL
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.3.4501.1418\swg.dll
BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_B7C5AC242193BB3E.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: Google Gears Helper: {e0fefe40-fbf9-42ae-ba58-794ca7e3fb53} - c:\program files\google\google gears\internet explorer\0.5.33.0\gears.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn0\YTSingleInstance.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
EB: {2AA2FBF8-9C76-4E97-A226-25C5F4AB6358} - No File
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized
mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
mRun: [Apoint] c:\program files\apoint2k\Apoint.exe
mRun: [Cpqset] c:\program files\hpq\default settings\cpqset.exe
mRun: [UpdateManager] "c:\program files\common files\sonic\update manager\sgtray.exe" /r
mRun: [hpWirelessAssistant] c:\program files\hpq\hp wireless assistant\HP Wireless Assistant.exe
mRun: [Symantec PIF AlertEng] "c:\program files\common files\symantec shared\pif\{b8e1dd85-8582-4c61-b58f-2f227fca9a08}\pifsvc.exe" /a /m "c:\program files\common files\symantec shared\pif\{b8e1dd85-8582-4c61-b58f-2f227fca9a08}\AlertEng.dll"
mRun: [IntelliPoint] "c:\program files\microsoft intellipoint\ipoint.exe"
mRun: [WatchDog] c:\program files\intervideo\dvd check\DVDCheck.exe
mRun: [AGRSMMSG] AGRSMMSG.exe
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
StartupFolder: c:\documents and settings\me\start menu\programs\startup\autorunsdisabled\hpqtra08.exe
StartupFolder: c:\documents and settings\me\start menu\programs\startup\autorunsdisabled\hpzinw12.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\dvdche~1.lnk - c:\program files\intervideo\dvd check\DVDCheck.exe
IE: &Search - ?p=ZNxmk572YYUS
IE: &Yahoo! Search - file:///c:\program files\yahoo!\Common/ycsrch.htm
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office11\EXCEL.EXE/3000
IE: Yahoo! &Dictionary - file:///c:\program files\yahoo!\Common/ycdict.htm
IE: Yahoo! &Maps - file:///c:\program files\yahoo!\Common/ycmap.htm
IE: Yahoo! &SMS - file:///c:\program files\yahoo!\Common/ycsms.htm
IE: {17709D14-4A02-42c6-B9FA-18C90A851F51} - c:\microgaming\poker\wildjackmpp\MPPoker.exe
IE: {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - c:\program files\pokerstars\PokerStarsUpdate.exe
IE: {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\program files\partygaming\partypoker\RunApp.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {F4430FE8-2638-42e5-B849-800749B94EED} - c:\program files\partygaming.net\partypokernet\RunPF.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - {0B4350D1-055F-47A3-B112-5F2F2B0D6F08} - c:\program files\google\google gears\internet explorer\0.5.33.0\gears.dll
IE: {5067A26B-1337-4436-8AFE-EE169C2DA79F} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
IE: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - c:\program files\yahoo!\common\yiesrvc.dll
IE: {77BF5300-1474-4EC7-9980-D32B190E9B07} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office11\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://download.microsoft.com/download/e/4/9/e494c802-dd90-4c6b-a074-469358f075a6/OGAControl.cab
DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper200711281.dll
DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} - hxxps://webdl.symantec.com/activex/symdlmgr.cab
DPF: {8A0019EB-51FA-4AE5-A40B-C0496BBFC739} - hxxp://picture.vzw.com/activex/VerizonWirelessUploadControl.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {9B17FE0E-51F2-4692-8B32-8EFB805FC0E7} - hxxp://h30155.www3.hp.com/ediags/dd/install/guidedsolutions.cab
DPF: {A7196C8E-35A5-4FF0-9E46-E28918B5CAF6} - hxxp://67.15.101.3/g_bin/eng/domino_2_0_0_32.cab
DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} - hxxps://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx
DPF: {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_08-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} - hxxp://www.adobe.com/products/acrobat/nos/gp.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} - hxxps://signin3.valueactive.com/Register/Branding/olr3313/OCX/v1018/flashax.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: igfxcui - igfxsrvc.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\me\applic~1\mozilla\firefox\profiles\hscmsm06.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-yma4&p=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - prefs.js: keyword.URL - hxxp://recovery.alexa.com/helper/?aid=VFEJa11Fhm00oF&plugin=spkyf-1.4.7&reason=keyword&location=
FF - component: c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\ipsffplgn\components\IPSFFPl.dll
FF - component: c:\documents and settings\me\application data\mozilla\firefox\profiles\hscmsm06.default\extensions\{7104ec46-5dfb-4609-84f0-915970e383d7}\components\FFExternalAlert.dll
FF - component: c:\program files\google\google gears\firefox\lib\ff35\gears.dll
FF - component: c:\program files\mozilla firefox\components\MGSHelper.dll
FF - plugin: c:\documents and settings\me\local settings\application data\yahoo!\browserplus\2.4.17\plugins\npybrowserplus_2.4.17.dll
FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\google\google updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\google\update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npqtplugin8.dll
FF - plugin: c:\program files\quicktime\plugins\npqtplugin8.dll
FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll
FF - plugin: c:\program files\xstandard\bin\NPXStandard.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

============= SERVICES / DRIVERS ===============

R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\nav\1007020.00b\SymEFA.sys [2009-8-31 310320]
R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\nav\1007020.00b\BHDrvx86.sys [2009-8-31 259632]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\nav\1007020.00b\cchpx86.sys [2009-8-31 482432]
R1 IDSxpx86;IDSxpx86;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\ipsdefs\20091111.001\IDSXpx86.sys [2009-11-12 329592]
R2 Norton AntiVirus;Norton AntiVirus;c:\program files\norton antivirus\norton antivirus\engine\16.7.2.11\ccSvcHst.exe [2009-8-31 117640]
R2 YahooAUService;Yahoo! Updater;c:\program files\yahoo!\softwareupdate\YahooAUService.exe [2008-11-9 602392]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2009-11-24 102448]
R3 NAVENG;NAVENG;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\virusdefs\20091125.004\NAVENG.SYS [2009-11-25 84912]
R3 NAVEX15;NAVEX15;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\virusdefs\20091125.004\NAVEX15.SYS [2009-11-25 1323568]
S2 gupdate1c9d517aa5a5782;Google Update Service (gupdate1c9d517aa5a5782);c:\program files\google\update\GoogleUpdate.exe [2009-5-14 133104]

=============== Created Last 30 ================

2009-11-20 12:11 56 a---h--- c:\windows\system32\ezsidmv.dat
2009-11-20 12:08 <DIR> --d--r-- c:\program files\Skype
2009-11-19 23:07 <DIR> a-dshr-- C:\cmdcons
2009-11-19 23:05 260,608 a------- c:\windows\PEV.exe
2009-11-19 23:05 161,792 a------- c:\windows\SWREG.exe
2009-11-19 23:05 98,816 a------- c:\windows\sed.exe
2009-11-19 23:05 77,312 a------- c:\windows\MBR.exe
2009-11-18 00:31 0 a------- c:\windows\system32\30.tmp
2009-11-18 00:31 0 a------- c:\windows\system32\2F.tmp
2009-11-17 03:26 1,293 a--sh--- c:\windows\system32\1761131589
2009-11-17 03:26 817 a------- c:\windows\system32\950594581
2009-11-17 03:20 <DIR> --dsh--- c:\windows\system32\SysWoW32
2009-11-17 03:19 <DIR> --d----- c:\windows\system32\177900402
2009-11-17 03:18 738,816 a--sh--- c:\windows\system32\11F.tmp
2009-11-17 03:18 121,344 -------- c:\windows\system32\vbrcaibm.hvv
2009-11-17 02:45 <DIR> --d----- c:\docume~1\me\applic~1\LimeWire
2009-10-30 17:14 274,288 a------- c:\windows\system32\mucltui.dll
2009-10-30 17:14 215,920 a------- c:\windows\system32\muweb.dll
2009-10-30 17:14 16,736 a------- c:\windows\system32\mucltui.dll.mui
2009-10-29 01:20 <DIR> --d----- c:\docume~1\me\applic~1\Mozilla-Cache

==================== Find3M ====================

2009-09-24 12:23 68,940 a------- c:\windows\hpoins05.dat
2009-09-23 13:19 1,044,480 a----r-- c:\windows\system32\roboex32.dll
2009-09-23 13:19 49,152 a----r-- c:\windows\system32\inetwh32.dll
2009-09-11 08:18 136,192 a------- c:\windows\system32\msv1_0.dll
2009-09-04 15:03 58,880 a------- c:\windows\system32\msasn1.dll
2009-08-29 02:08 916,480 -------- c:\windows\system32\wininet.dll
2009-02-12 18:42 60,744 a------- c:\documents and settings\me\g2mdlhlpx.exe
2009-02-09 22:24 1,024 a------- c:\docume~1\alluse~1\applic~1\pdfppt2.dll
2008-09-06 19:17 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008090620080907\index.dat

============= FINISH: 15:59:20.96 ===============





UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-09-29.01)

Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume1
Install Date: 7/21/2006 2:12:08 PM
System Uptime: 11/25/2009 9:17:20 AM (6 hours ago)

Motherboard: Hewlett-Packard | | 09BC
Processor: Intel(R) Pentium(R) M processor 1.60GHz | U1 | 1596/533mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 93 GiB total, 62.361 GiB free.
D: is CDROM ()

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP857: 8/28/2009 8:40:09 AM - System Checkpoint
RP858: 8/29/2009 9:44:29 AM - System Checkpoint
RP859: 8/30/2009 4:20:04 PM - System Checkpoint
RP860: 8/31/2009 7:59:14 PM - System Checkpoint
RP861: 9/1/2009 8:47:12 PM - System Checkpoint
RP862: 9/2/2009 9:53:53 PM - System Checkpoint
RP863: 9/4/2009 1:35:01 AM - System Checkpoint
RP864: 9/5/2009 5:29:15 AM - System Checkpoint
RP865: 9/5/2009 7:15:15 PM - Removed Google AdWords Editor
RP866: 9/5/2009 7:16:12 PM - Removed Google AdWords Editor
RP867: 9/5/2009 7:17:51 PM - Removed Google Earth.
RP868: 9/6/2009 8:47:59 PM - System Checkpoint
RP869: 9/7/2009 2:53:23 PM - Installed Java(TM) 6 Update 15
RP870: 9/8/2009 8:29:09 PM - System Checkpoint
RP871: 9/9/2009 3:00:20 AM - Software Distribution Service 3.0
RP872: 9/10/2009 4:27:22 AM - System Checkpoint
RP873: 9/11/2009 5:00:26 AM - System Checkpoint
RP874: 9/12/2009 6:38:04 AM - System Checkpoint
RP875: 9/13/2009 8:04:54 AM - System Checkpoint
RP876: 9/15/2009 2:00:42 PM - System Checkpoint
RP877: 9/16/2009 2:16:59 PM - System Checkpoint
RP878: 9/17/2009 3:03:42 PM - System Checkpoint
RP879: 9/18/2009 3:11:08 AM - Removed Brute Force Seo
RP880: 9/18/2009 3:13:48 AM - Installed Brute Force Seo
RP881: 9/19/2009 1:07:38 PM - System Checkpoint
RP882: 9/20/2009 7:06:11 PM - System Checkpoint
RP883: 9/21/2009 6:34:04 PM - Software Distribution Service 3.0
RP884: 9/22/2009 10:11:54 PM - System Checkpoint
RP885: 9/24/2009 2:02:19 AM - System Checkpoint
RP886: 9/24/2009 1:13:40 PM - Printer Driver HP Photosmart 2700 series Installed
RP887: 9/24/2009 1:20:55 PM - Printer Driver HP Photosmart 2700 series fax Installed
RP888: 9/24/2009 1:22:52 PM - Printer Driver HP remote printers Installed
RP889: 9/24/2009 1:24:13 PM - Printer Driver HP remote printers Installed
RP890: 9/24/2009 2:13:50 PM - Removed Adobe Reader 8.1.5
RP891: 9/24/2009 2:15:47 PM - Installed Adobe Reader 9.1.
RP892: 9/25/2009 2:26:22 PM - System Checkpoint
RP893: 9/25/2009 7:25:37 PM - Installed Google AdWords Editor
RP894: 9/27/2009 5:31:51 PM - System Checkpoint
RP895: 9/28/2009 10:32:14 PM - System Checkpoint
RP896: 9/30/2009 3:39:24 AM - System Checkpoint
RP897: 10/1/2009 6:04:58 AM - System Checkpoint
RP898: 10/2/2009 6:11:04 AM - System Checkpoint
RP899: 10/3/2009 9:44:04 AM - System Checkpoint
RP900: 10/4/2009 10:20:02 AM - System Checkpoint
RP901: 10/6/2009 10:07:56 PM - System Checkpoint
RP902: 10/7/2009 10:30:29 PM - System Checkpoint
RP903: 10/8/2009 1:45:36 AM - Installed Brute Force Keyword Generator
RP904: 10/9/2009 2:31:34 AM - System Checkpoint
RP905: 10/10/2009 3:30:32 AM - System Checkpoint
RP906: 10/11/2009 7:56:05 AM - System Checkpoint
RP907: 10/12/2009 8:52:26 AM - System Checkpoint
RP908: 10/13/2009 9:52:39 AM - System Checkpoint
RP909: 10/14/2009 10:52:30 AM - System Checkpoint
RP910: 10/15/2009 5:35:08 PM - System Checkpoint
RP911: 10/16/2009 4:32:43 PM - Software Distribution Service 3.0
RP912: 10/18/2009 6:55:45 PM - System Checkpoint
RP913: 10/20/2009 12:56:11 AM - System Checkpoint
RP914: 10/21/2009 1:56:26 AM - System Checkpoint
RP915: 10/21/2009 10:21:38 PM - Software Distribution Service 3.0
RP916: 10/22/2009 3:12:18 PM - Installed Turbo Lister 2.
RP917: 10/23/2009 5:51:46 PM - System Checkpoint
RP918: 10/24/2009 6:15:36 PM - System Checkpoint
RP919: 10/26/2009 2:32:41 PM - System Checkpoint
RP920: 10/27/2009 11:18:33 PM - System Checkpoint
RP921: 10/29/2009 12:33:40 AM - System Checkpoint
RP922: 10/30/2009 9:47:36 PM - System Checkpoint
RP923: 10/30/2009 10:48:06 PM - Software Distribution Service 3.0
RP924: 11/1/2009 1:58:37 AM - System Checkpoint
RP925: 11/1/2009 3:01:18 AM - Software Distribution Service 3.0
RP926: 11/2/2009 1:26:08 PM - System Checkpoint
RP927: 11/4/2009 10:10:07 AM - System Checkpoint
RP928: 11/5/2009 4:32:39 PM - System Checkpoint
RP929: 11/6/2009 6:25:25 PM - System Checkpoint
RP930: 11/7/2009 6:43:22 PM - System Checkpoint
RP931: 11/7/2009 10:41:59 PM - Software Distribution Service 3.0
RP932: 11/8/2009 10:52:26 PM - System Checkpoint
RP933: 11/10/2009 12:04:25 AM - System Checkpoint
RP934: 11/10/2009 11:00:41 PM - Software Distribution Service 3.0
RP935: 11/12/2009 7:38:40 AM - System Checkpoint
RP936: 11/13/2009 9:34:37 PM - System Checkpoint
RP937: 11/15/2009 5:04:30 PM - System Checkpoint
RP938: 11/16/2009 8:56:34 PM - Installed Google AdWords Editor
RP939: 11/17/2009 4:15:20 AM - Software Distribution Service 3.0
RP940: 11/18/2009 4:48:20 AM - System Checkpoint
RP941: 11/19/2009 4:49:04 AM - System Checkpoint
RP942: 11/20/2009 7:33:31 PM - System Checkpoint
RP943: 11/21/2009 7:37:09 PM - System Checkpoint
RP944: 11/23/2009 12:00:41 AM - System Checkpoint
RP945: 11/24/2009 12:55:41 AM - System Checkpoint
RP946: 11/25/2009 3:01:27 AM - Software Distribution Service 3.0

==== Installed Programs ======================

2600_Help
2600Trb
2700
AAC Decoder
Ad Words Digger
Adobe AIR
Adobe Atmosphere Player for Acrobat and Adobe Reader
Adobe Flash Player 10 Plugin
Adobe Flash Player ActiveX
Adobe Media Player
Adobe Reader 9.2
Agere Systems AC'97 Modem
AiO_Scan
AiOSoftware
ALPS Touch Pad Driver
Apple Mobile Device Support
Apple Software Update
ArcSoft PhotoImpression 4
Article Submitter 1.4
Artisteer 2
AutoUpdate
BitPim 1.0.6
Bonjour
Broadcom 802.11 Driver
Brute Force Keyword Generator
Brute Force Linking Loophole
Brute Force Seo
BufferChm
CB Niche Builder
Compatibility Pack for the 2007 Office system
Convert Word to HTML V1.50
Copy
Copywriting Automator
CP_AtenaShokunin1Config
cp_dwShrek2Albums1
cp_dwShrek2Cards1
CreativeProjects
CreativeProjectsTemplates
Critical Update for Windows Media Player 11 (KB959772)
CueTour
Destinations
Digital Camera Driver
Director
Directory Submitter 1.0.29
DivX Codec
DivX Converter
DivX Player
DivX Plus DirectShow Filters
DivX Version Checker
DivX Web Player
DocProc
DocumentViewer
ERUNT 1.1j
Fax
FileZilla Client 3.2.4.1
Free PDF to Word Doc Converter v1.1
Free PowerPoint/PPT to Pdf Converter 5.1
Free PS Convert driver 8.15
GC Affiliate Cloaker
getPlus(R)_ocx
GIMP 2.4.6
Google AdWords Editor
Google Chrome
Google Earth
Google Gears
Google Toolbar for Internet Explorer
Google Update Helper
Google Updater
GoToMeeting 4.0.0.320
H.264 Decoder
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB915800-v4)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
HP Extended Capabilities 4.7
HP Help and Support
HP Image Zone 4.7
HP Product Assistant
HP PSC & OfficeJet 4.7
HP Software Update
HP Unload DLL Patch
HP Update
HP Wireless Assistant
HPSystemDiagnostics
HTML Email Preparation Tool V.1
HTML Executable IERuntime
Instant Autoresponder Messages
InstantShare
Intel(R) Graphics Media Accelerator Driver for Mobile
InterVideo DVD Check
InterVideo WinDVD
Ipswitch WS_FTP Home 2007
iTunes
J2SE Runtime Environment 5.0
J2SE Runtime Environment 5.0 Update 10
J2SE Runtime Environment 5.0 Update 8
Java(TM) 6 Update 15
Java(TM) 6 Update 3
Java(TM) 6 Update 5
Java(TM) 6 Update 7
Jing
K-Lite Codec Pack 4.9.5 (Standard)
LG USB Modem driver
LiveUpdate Notice (Symantec Corporation)
Market Samurai
MarketResearch
MemoriesOnWeb 3.1.7
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB953297)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Application Error Reporting
Microsoft Base Smart Card Cryptographic Service Provider Package
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft IntelliPoint 6.3
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
Microsoft National Language Support Downlevel APIs
Microsoft Office Standard Edition 2003
Microsoft Silverlight
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
MKV Splitter
Mozilla Firefox (3.5.5)
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 6.0 Parser (KB925673)
My Free Web Site Builder
NCH Toolbox
Norton AntiVirus
Nvu 1.0
Optin Buzz Brander
PanoStandAlone
PartyPoker
PartyPoker.net
PhotoGallery
Pixillion Image Converter
Podcast Assistant In A Box 1.0
PokerStars
PPT to PDF Converter 3.00
ProductContext
Project Buzz
QFolder
Quick Launch Buttons 5.00 D5
QuickTime
Readme
REALTEK Gigabit and Fast Ethernet NIC Driver
RFFlow
Scan
ScannerCopy
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 8 (KB969897)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB972260)
Security Update for Windows Internet Explorer 8 (KB974455)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 9 (KB917734)
Security Update for Windows Search 4 - KB963093
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
SkinsHP1
Skype web features
Skype™ 4.1
SmartDraw 2009
Snagit 9.1.2
Sonic RecordNow!
Sonic Update Manager
SoundMAX
Spybot - Search & Destroy
Squeeze Buzz v2.0
Subliminal $SUBLIMINAL_VERSION
Texas Instruments PCIxx21/x515 drivers.
TIxx21/x515
TrayApp
Turbo Lister 2
TweetDeck
Unload
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 8 (KB968220)
Update for Windows Internet Explorer 8 (KB972636)
Update for Windows Internet Explorer 8 (KB973874)
Update for Windows Internet Explorer 8 (KB976749)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
URGE
VC80CRTRedist - 8.0.50727.762
VideoPad Video Editor
WebFldrs XP
WebReg
Wild Jack Casino
Wild Jack Poker
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 7
Windows Internet Explorer 8
Windows Media Format 11 runtime
Windows Media Player 11
Windows Presentation Foundation
Windows Search 4.0
Windows XP Service Pack 3
WinZip 11.1
Word Mojo Deluxe
XML Paper Specification Shared Components Pack 1.0
XStandard
Yahoo! Browser Services
Yahoo! BrowserPlus
Yahoo! Internet Mail
Yahoo! Messenger
Yahoo! Search Protection
Yahoo! Software Update
Yahoo! Toolbar
ZIP Reader 8.00.0018

==== Event Viewer Messages From Past Week ========

11/25/2009 9:23:19 AM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the JavaQuickStarterService service.
11/25/2009 9:15:56 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the IMAPI CD-Burning COM Service service to connect.
11/25/2009 9:15:56 AM, error: Service Control Manager [7000] - The IMAPI CD-Burning COM Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
11/25/2009 9:13:14 AM, error: Dhcp [1002] - The IP address lease 192.168.10.2 for the Network Card with network address 0012F0198EE4 has been denied by the DHCP server 192.168.0.1 (The DHCP Server sent a DHCPNACK message).
11/20/2009 9:47:13 AM, error: PSched [14103] - QoS [Adapter {126E0227-B703-470D-84A5-CAC4C9F4DBB5}]: The netcard driver failed the query for OID_GEN_LINK_SPEED.
11/19/2009 12:57:53 AM, error: Service Control Manager [7034] - The Java Quick Starter service terminated unexpectedly. It has done this 1 time(s).
11/19/2009 12:57:22 AM, error: Service Control Manager [7034] - The Application Layer Gateway Service service terminated unexpectedly. It has done this 1 time(s).
11/19/2009 12:54:29 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the HTTP SSL service to connect.
11/19/2009 12:54:29 AM, error: Service Control Manager [7000] - The HTTP SSL service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
11/19/2009 11:36:16 PM, error: Print [19] - Sharing printer failed + 1722, Printer PDFConverter share name PDFConverter.
11/19/2009 10:10:12 PM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC0000243' while processing the file 'SrtETmp' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume.

==== End Of File ===========================

[Blade81]

Hi,

Do NOT run 'FIXES' (ComboFix etc) without being asked (http://forums.spybot.info/showthread.php?t=16806) -sticky

Seems that ComboFix has been run there earlier. Please post contents of c:\ComboFix.txt file.

[ericl]

ComboFix 09-11-19.05 - Me 11/19/2009 23:16.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1270.612 [GMT -6:00]
Running from: c:\documents and settings\Me\Desktop\ComboFix.exe
AV: Norton AntiVirus *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton AntiVirus *enabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Me\Application Data\020000002bec8da4697C.manifest
c:\documents and settings\Me\Application Data\020000002bec8da4697O.manifest
c:\documents and settings\Me\Application Data\020000002bec8da4697P.manifest
c:\documents and settings\Me\Application Data\020000002bec8da4697S.manifest
c:\program files\MyWebSearch
c:\recycler\S-1-5-21-1844237615-1035525444-725345543-1003
c:\windows\GnuHashes.ini
c:\windows\system32\__c00A2CC3.dat
c:\windows\system32\717305
c:\windows\system32\DMIME32.DLL
c:\windows\system32\dpnlobby32.dll
c:\windows\system32\unrar.exe

Infected copy of c:\windows\system32\drivers\ntfs.sys was found and disinfected
Restored copy from - c:\windows\ServicePackFiles\i386\ntfs.sys

.
((((((((((((((((((((((((( Files Created from 2009-10-20 to 2009-11-20 )))))))))))))))))))))))))))))))
.

2009-11-20 05:36 . 2009-08-22 06:37 165240 ----a-r- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\IPSFFPlgn\components\IPSFFPl.dll
2009-11-20 03:38 . 2009-11-20 03:39 -------- d-----w- c:\program files\ERUNT
2009-11-20 02:07 . 2009-09-22 08:00 259440 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091119.024\ECMSVR32.DLL
2009-11-20 02:07 . 2009-09-15 08:00 2747952 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091119.024\CCERASER.DLL
2009-11-20 02:07 . 2009-08-26 08:00 371248 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091119.024\EECTRL.SYS
2009-11-20 02:07 . 2009-08-26 08:00 102448 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091119.024\ERASER.SYS
2009-11-20 02:07 . 2009-08-25 08:00 84912 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091119.024\NAVENG.SYS
2009-11-20 02:07 . 2009-08-25 08:00 177520 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091119.024\NAVENG32.DLL
2009-11-20 02:07 . 2009-08-25 08:00 1647984 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091119.024\NAVEX32A.DLL
2009-11-20 02:07 . 2009-08-25 08:00 1323568 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091119.024\NAVEX15.SYS
2009-11-17 09:27 . 2009-11-17 09:27 187904 ----a-w- c:\windows\system32\expsrv32.dll
2009-11-17 09:20 . 2009-11-17 09:26 -------- d-sh--w- c:\windows\system32\SysWoW32
2009-11-17 09:19 . 2009-11-17 09:25 -------- d-----w- c:\windows\system32\177900402
2009-11-17 08:45 . 2009-11-17 09:27 -------- d-----w- c:\documents and settings\Me\Application Data\LimeWire
2009-11-12 21:05 . 2009-10-28 22:37 329592 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091111.001\IDSXpx86.sys
2009-11-12 21:05 . 2009-10-28 22:37 811896 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091111.001\Scxpx86.dll
2009-11-12 21:05 . 2009-10-28 22:37 488312 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091111.001\IDSxpx86.dll
2009-11-12 21:05 . 2009-10-28 22:37 343088 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091111.001\IDSvix86.sys
2009-11-12 21:05 . 2009-10-28 22:37 466992 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091111.001\IDSviA64.sys
2009-11-11 20:31 . 2009-10-28 22:37 329592 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091107.001\IDSXpx86.sys
2009-11-11 20:31 . 2009-10-28 22:37 811896 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091107.001\Scxpx86.dll
2009-11-11 20:31 . 2009-10-28 22:37 343088 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091107.001\IDSvix86.sys
2009-11-11 20:31 . 2009-10-28 22:37 488312 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091107.001\IDSxpx86.dll
2009-11-11 20:31 . 2009-10-28 22:37 466992 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091107.001\IDSviA64.sys
2009-11-06 18:57 . 2009-10-28 22:37 343088 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091105.001\IDSvix86.sys
2009-11-06 18:57 . 2009-10-28 22:37 329592 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091105.001\IDSXpx86.sys
2009-11-06 18:57 . 2009-10-28 22:37 811896 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091105.001\Scxpx86.dll
2009-11-06 18:57 . 2009-10-28 22:37 488312 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091105.001\IDSxpx86.dll
2009-11-06 18:57 . 2009-10-28 22:37 466992 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091105.001\IDSviA64.sys
2009-10-30 23:14 . 2009-08-07 00:23 274288 ----a-w- c:\windows\system32\mucltui.dll
2009-10-30 23:14 . 2009-08-07 00:23 215920 ----a-w- c:\windows\system32\muweb.dll
2009-10-29 20:11 . 2009-10-29 20:11 -------- d-----w- c:\program files\Microsoft Silverlight
2009-10-29 07:20 . 2009-10-29 07:20 -------- d-----w- c:\documents and settings\Me\Application Data\Mozilla-Cache
2009-10-28 22:37 . 2009-10-28 22:37 343088 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\IDSvix86.sys
2009-10-28 22:37 . 2009-10-28 22:37 329592 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\IDSXpx86.sys
2009-10-28 22:37 . 2009-10-28 22:37 811896 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\Scxpx86.dll
2009-10-28 22:37 . 2009-10-28 22:37 488312 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\IDSxpx86.dll
2009-10-28 22:37 . 2009-10-28 22:37 466992 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\IDSviA64.sys
2009-10-24 07:39 . 2009-11-04 04:56 236280 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-10-22 20:12 . 2009-10-22 20:12 -------- d-----w- c:\program files\eBay
2009-10-22 20:12 . 2009-10-22 20:12 -------- d-----w- c:\documents and settings\All Users\eBay

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-19 10:06 . 2008-06-26 05:40 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2009-11-18 06:31 . 2009-11-18 06:31 0 ----a-w- c:\windows\system32\30.tmp
2009-11-18 06:31 . 2009-11-18 06:31 0 ----a-w- c:\windows\system32\2F.tmp
2009-11-17 09:18 . 2009-11-17 09:18 738816 --sha-w- c:\windows\system32\11F.tmp
2009-11-17 02:57 . 2006-08-26 00:43 -------- d-----w- c:\program files\Google
2009-11-16 10:23 . 2008-04-24 18:20 -------- d-----w- c:\documents and settings\Me\Application Data\FileZilla
2009-11-15 22:01 . 2009-09-11 05:41 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-11-14 20:18 . 2006-07-22 21:26 50776 ----a-w- c:\documents and settings\Me\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-07 02:22 . 2008-06-17 02:01 -------- d-----w- c:\documents and settings\Me\Application Data\gtk-2.0
2009-11-03 22:20 . 2009-02-18 02:40 664 ----a-w- c:\windows\system32\d3d9caps.dat
2009-10-29 07:20 . 2006-07-22 04:23 -------- d-----w- c:\program files\PartyGaming.Net
2009-10-29 07:06 . 2008-04-27 08:12 -------- d-----w- c:\program files\PartyGaming
2009-10-13 23:21 . 2006-07-22 22:56 -------- d-----w- c:\program files\Common Files\Adobe
2009-10-11 07:00 . 2008-04-28 20:33 -------- d-----w- c:\documents and settings\Me\Application Data\Microgaming
2009-10-08 06:45 . 2008-10-13 03:22 -------- d-----w- c:\program files\Peter Drew
2009-09-24 23:04 . 2009-07-10 10:16 -------- d-----w- c:\documents and settings\All Users\Application Data\NCH Software
2009-09-24 23:03 . 2009-07-10 10:11 -------- d-----w- c:\program files\NCH Software
2009-09-24 19:31 . 2006-07-06 07:35 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2009-09-24 19:24 . 2009-09-24 19:09 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2009-09-24 19:10 . 2009-09-24 19:09 86016 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\arh.exe
2009-09-24 18:23 . 2009-01-13 03:07 68940 ----a-w- c:\windows\hpoins05.dat
2009-09-24 18:20 . 2009-09-24 18:20 -------- d-----w- c:\documents and settings\All Users\Application Data\HP
2009-09-24 18:18 . 2009-09-24 18:18 -------- d-----w- c:\program files\Common Files\HP
2009-09-24 18:16 . 2006-07-22 21:05 -------- d-----w- c:\program files\HP
2009-09-24 18:16 . 2006-07-22 23:28 -------- d-----w- c:\program files\Hewlett-Packard
2009-09-24 17:01 . 2009-09-24 17:01 -------- d-----w- c:\documents and settings\Me\Application Data\Windows Search
2009-09-23 21:09 . 2009-09-23 21:09 -------- d-----w- c:\documents and settings\Me\Application Data\TweetDeckFast.F9107117265DB7542C1A806C8DB837742CE14C21.1
2009-09-23 21:09 . 2009-09-23 21:09 -------- d-----w- c:\program files\TweetDeck
2009-09-23 19:19 . 2009-09-23 19:19 49152 ----a-r- c:\windows\system32\inetwh32.dll
2009-09-23 19:19 . 2009-09-23 19:19 1044480 ----a-r- c:\windows\system32\roboex32.dll
2009-09-18 08:13 . 2009-09-18 08:13 8302 ----a-r- c:\documents and settings\Me\Application Data\Microsoft\Installer\{FAB88294-6EE7-4F83-9097-8E7819724EF8}\_784BC2CC2DBADFC11854EC.exe
2009-09-18 08:13 . 2009-09-18 08:13 8302 ----a-r- c:\documents and settings\Me\Application Data\Microsoft\Installer\{FAB88294-6EE7-4F83-9097-8E7819724EF8}\_5C61E917AB8C8724D932D5.exe
2009-09-18 08:13 . 2009-09-18 08:13 8302 ----a-r- c:\documents and settings\Me\Application Data\Microsoft\Installer\{FAB88294-6EE7-4F83-9097-8E7819724EF8}\_31A30127C2C6832B6BBA9D.exe
2009-09-18 08:13 . 2009-09-18 08:13 1406 ----a-r- c:\documents and settings\Me\Application Data\Microsoft\Installer\{FAB88294-6EE7-4F83-9097-8E7819724EF8}\_8EEE255E964F0BE8010286.exe
2009-09-18 08:13 . 2009-09-18 08:13 1406 ----a-r- c:\documents and settings\Me\Application Data\Microsoft\Installer\{FAB88294-6EE7-4F83-9097-8E7819724EF8}\_698165531D8150AEDAB23E.exe
2009-09-17 06:49 . 2009-09-17 06:49 1204224 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\m\multistagepickxofybonus.3a30a9c7b165f5e8a337ca88ed08906c.dll
2009-09-17 06:46 . 2009-09-17 06:46 860160 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\s\scoopthecashbonus.bba34ca69d484ca056b3150cf3511c31.dll
2009-09-17 06:45 . 2009-09-17 06:45 831488 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\r\racebonus.0a92bce3bdb7feb1970ec9894848e1ee.dll
2009-09-17 06:43 . 2009-09-17 06:43 1171456 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\w\wealthspa_stonebonus.884fe3f012cc21e9f4b94beccb344fe5.dll
2009-09-17 06:43 . 2009-09-17 06:43 1204224 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\w\wealthspa_bathbonus.eaf1477312e7ecb9b1c7aa0a26e6ac61.dll
2009-09-17 06:42 . 2009-09-17 06:42 1142784 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\w\wealthspa_bodywaxbonus.86b2e4bb4c8e68cbf84cdb6310c39218.dll
2009-09-17 06:41 . 2009-09-17 06:41 1290240 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\w\wealthspa_smoothiebonus.779ec9c8439f59a40852d4a998367c4f.dll
2009-09-17 06:40 . 2009-09-17 06:40 827392 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\p\playerinstantiatedchoosebonus.ceb25d7dda7b0effc207d3dec6e30288.dll
2009-09-17 06:39 . 2009-09-17 06:39 1196032 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\w\wealthspa_massagebonus.0e575cb178075b87da73199c7e3bdcc1.dll
2009-09-11 14:18 . 2004-08-04 12:00 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-11 01:07 . 2009-09-11 01:07 1024000 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\s\simplepickxofychoicebonus_summerholiday.2f3c0065ff052710ed0c13651e2571da.dll
2009-09-11 01:05 . 2009-09-11 01:05 679936 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\t\transition_septgao_09.04686bb06cfe59ecb3f271eb95218422.dll
2009-09-11 01:05 . 2009-09-11 01:05 679936 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\t\transition_wealthspa.5a3f4e96415d8b3050681cdd275f3d88.dll
2009-09-11 01:05 . 2009-09-11 01:05 1478656 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\a\advancedslots1_septgao_09.1d5fda158c9a9d1dcbf9e88c5355d884.dll
2009-09-11 01:05 . 2009-09-11 01:05 1032192 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\a\advancedslots1xxx_wealthspa.2cac89b1bff8f25a6a8d3748201af558.dll
2009-09-11 01:05 . 2009-09-11 01:05 1040384 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\a\advancedslots1xxx_septgao_09.02b3e0bc2a35757d7c030659fd21c70a.dll
2009-09-11 01:05 . 2009-09-11 01:05 1224704 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\a\advancedslots1xxx_summerholiday.ca5125cc93020b208c8104895ffd4a80.dll
2009-09-11 01:05 . 2009-09-11 01:05 1474560 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\a\advancedslots1_wealthspa.548276e787b133afb9b912eb95b8b5c5.dll
2009-09-11 01:05 . 2009-09-11 01:05 1638400 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\a\advancedslots1_summerholiday.19e3e7b6f28b2f036c0b87d00fc799b9.dll
2009-09-11 01:05 . 2009-09-11 01:05 618496 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\g\gamble2_wealthspa.a58c586ab4d974ea2d4142fb4d851c2b.dll
2009-09-11 01:05 . 2009-09-11 01:05 618496 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\g\gamble2_septgao_09.d8cd6b206ce4b18e0867e42785806a63.dll
2009-09-11 01:05 . 2009-09-11 01:05 606208 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\g\gamble2_summerholiday.b02744e18c4cdb3dd3394f69d8987073.dll
2009-09-11 00:36 . 2009-09-11 00:36 417792 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\m\menucore.e2df50a5930ba5d46a68f5564d204ba0.dll
2009-09-07 19:50 . 2009-09-07 19:50 152576 ----a-w- c:\documents and settings\Me\Application Data\Sun\Java\jre1.6.0_15\lzma.dll
2009-09-04 21:03 . 2004-08-04 12:00 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-08-29 08:08 . 2004-08-04 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2009-08-26 08:00 . 2004-08-04 12:00 247326 ----a-w- c:\windows\system32\strmdll.dll
2007-11-09 21:25 . 2008-07-26 18:57 57344 ----a-w- c:\program files\mozilla firefox\components\MGSHelper.dll
2009-04-15 20:24 . 2009-04-15 20:24 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-04-15 20:24 . 2009-04-15 20:24 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-06-26 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2005-02-08 159744]
"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2004-09-07 213054]
"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 110592]
"hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2004-12-08 790528]
"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifSvc.exe" [2008-01-29 583048]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2008-06-10 1406024]
"WatchDog"="c:\program files\InterVideo\DVD Check\DVDCheck.exe" [2004-12-09 184320]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-26 413696]
"AGRSMMSG"="AGRSMMSG.exe" - c:\windows\AGRSMMSG.exe [2005-04-13 88209]

c:\documents and settings\Me\Start Menu\Programs\Startup\AutorunsDisabled
hpqtra08.exe [2004-5-28 241664]
hpzinw12.exe [2004-9-29 61440]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
DVD Check.lnk - c:\program files\InterVideo\DVD Check\DVDCheck.exe [2006-7-6 184320]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]
@="FSFilter Activity Monitor"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk.disabled]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk.disabled
backup=c:\windows\pss\HP Digital Imaging Monitor.lnk.disabledCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk.disabled]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk.disabled
backup=c:\windows\pss\HP Image Zone Fast Start.lnk.disabledCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Windows Search.lnk.disabled]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk.disabled
backup=c:\windows\pss\Windows Search.lnk.disabledCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Me^Start Menu^Programs^Startup^hpqtra08.exe]
path=c:\documents and settings\Me\Start Menu\Programs\Startup\hpqtra08.exe
backup=c:\windows\pss\hpqtra08.exeStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Me^Start Menu^Programs^Startup^HPZinw12.exe]
path=c:\documents and settings\Me\Start Menu\Programs\Startup\HPZinw12.exe
backup=c:\windows\pss\HPZinw12.exeStartup

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
"MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" /background
"YSearchProtection"=c:\program files\Yahoo!\Search Protection\SearchProtection.exe
"Search Protection"=c:\program files\Yahoo!\Search Protection\SearchProtection.exe
"ctfmon.exe"=c:\windows\system32\ctfmon.exe
"MyWebSearch Email Plugin"=c:\progra~1\MYWEBS~1\bar\1.bin\mwsoemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe"
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
"PHIME2002ASync"=c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
"PHIME2002A"=c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
"KernelFaultCheck"=%systemroot%\system32\dumprep 0 -k
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe"
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe"
"WatchDog"=c:\program files\InterVideo\DVD Check\DVDCheck.exe
"SoundMAX"=c:\program files\Analog Devices\SoundMAX\Smax4.exe /tray
"SoundMAXPnP"=c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe"
"IgfxTray"=c:\windows\system32\igfxtray.exe
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"HotKeysCmds"=c:\windows\system32\hkcmd.exe
"eabconfg.cpl"=c:\program files\HPQ\Quick Launch Buttons\EabServr.exe /Start
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"MSConfig"=c:\windows\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
"MyWebSearch Email Plugin"=c:\progra~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
"My Web Search Bar Search Scope Monitor"="c:\progra~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe" /m=0

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\spoolsv.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\TEMP\\HP_WebRelease\\Setup\\HPZnet01.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\WINDOWS\\system32\\java.exe"=

R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NAV\1007020.00B\SymEFA.sys [8/31/2009 5:16 PM 310320]
R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\NAV\1007020.00B\BHDrvx86.sys [8/31/2009 5:16 PM 259632]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NAV\1007020.00B\cchpx86.sys [8/31/2009 5:04 PM 482432]
R1 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091111.001\IDSXpx86.sys [11/12/2009 3:05 PM 329592]
R2 Norton AntiVirus;Norton AntiVirus;c:\program files\Norton AntiVirus\Norton AntiVirus\Engine\16.7.2.11\ccSvcHst.exe [8/31/2009 5:15 PM 117640]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [9/26/2009 5:50 PM 102448]
S2 gupdate1c9d517aa5a5782;Google Update Service (gupdate1c9d517aa5a5782);c:\program files\Google\Update\GoogleUpdate.exe [5/14/2009 10:43 PM 133104]
.
Contents of the 'Scheduled Tasks' folder

2009-11-20 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

2009-11-20 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-01-24 17:15]

2009-11-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-15 04:43]

2009-11-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-15 04:43]

2009-11-20 c:\windows\Tasks\SDMsgUpdate (TE).job
- c:\progra~1\SMARTD~1\Messages\SDNotify.exe [2009-01-30 12:29]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com
uSearchMigratedDefaultURL = hxxp://www.mywebsearch.com/jsp/cfg_redir2.jsp?id=ZNxmk572YYUS&fl=0&ptb=CU15EGtDfuo_BX.6DtQy9A&url=http://www.ask.com/web&q={searchTerms}&l=zn&o=sb
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Search - ?p=ZNxmk572YYUS
IE: &Yahoo! Search - file:///c:\program files\Yahoo!\Common/ycsrch.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
IE: Yahoo! &Dictionary - file:///c:\program files\Yahoo!\Common/ycdict.htm
IE: Yahoo! &Maps - file:///c:\program files\Yahoo!\Common/ycmap.htm
IE: Yahoo! &SMS - file:///c:\program files\Yahoo!\Common/ycsms.htm
IE: {{17709D14-4A02-42c6-B9FA-18C90A851F51} - c:\microgaming\Poker\wildjackMPP\MPPoker.exe
FF - ProfilePath - c:\documents and settings\Me\Application Data\Mozilla\Firefox\Profiles\hscmsm06.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-yma4&p=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-yma4&p=
FF - component: c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\IPSFFPlgn\components\IPSFFPl.dll
FF - component: c:\documents and settings\Me\Application Data\Mozilla\Firefox\Profiles\hscmsm06.default\extensions\{7104ec46-5dfb-4609-84f0-915970e383d7}\components\FFExternalAlert.dll
FF - component: c:\program files\Google\Google Gears\Firefox\lib\ff35\gears.dll
FF - component: c:\program files\Mozilla Firefox\components\MGSHelper.dll
FF - plugin: c:\documents and settings\Me\Local Settings\Application Data\Yahoo!\BrowserPlus\2.4.17\Plugins\npybrowserplus_2.4.17.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npqtplugin8.dll
FF - plugin: c:\program files\QuickTime\Plugins\npqtplugin8.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
FF - plugin: c:\program files\XStandard\Bin\NPXStandard.dll

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)
Notify-38a8ec15697 - c:\windows\System32\dmime32.dll
AddRemove-360Share Pro - c:\program files\360Share Pro\bt-uninst.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-19 23:37
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe????????0?4?1?0??????? ???B???????????????B? ??????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Norton AntiVirus]
"ImagePath"="\"c:\program files\Norton AntiVirus\Norton AntiVirus\Engine\16.7.2.11\ccSvcHst.exe\" /s \"Norton AntiVirus\" /m \"c:\program files\Norton AntiVirus\Norton AntiVirus\Engine\16.7.2.11\diMaster.dll\" /prefetch:1"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1679765361-3058041043-3763034360-1006\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(252)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Google\Update\1.2.183.13\GoogleCrashHandler.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\HPZipm12.exe
c:\program files\Analog Devices\SoundMAX\SMAgent.exe
c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
c:\windows\system32\SearchIndexer.exe
c:\windows\system32\wscntfy.exe
c:\program files\Apoint2K\Apntex.exe
c:\program files\Microsoft IntelliPoint\dpupdchk.exe
c:\program files\HPQ\shared\hpqwmi.exe
c:\windows\system32\SearchProtocolHost.exe
c:\windows\system32\SearchFilterHost.exe
.
**************************************************************************
.
Completion time: 2009-11-19 23:52 - machine was rebooted
ComboFix-quarantined-files.txt 2009-11-20 05:52

Pre-Run: 67,078,758,400 bytes free
Post-Run: 67,211,247,616 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

- - End Of File - - DBA390E4A57C7AF8563FFB480CCC78A1

[Blade81]

Hi again,

Upload c:\windows\system32\expsrv32.dll file to http://www.virustotal.com and post back the results.


Disable Spybot's TeaTimer to make sure it won't interfere with fixes. You can re-enable it when you're clean again:
Run Spybot-S&D in Advanced Mode
If it is not already set to do this, go to the Mode menu
select
Advanced Mode

On the left hand side, click on Tools
Then click on the Resident icon in the list
Uncheck
Resident TeaTimer
and OK any prompts.
Restart your computer


Open notepad and copy/paste the text in the quotebox below into it:



DirLook::
c:\windows\system32\SysWoW32
c:\windows\system32\177900402
FileLook::
c:\windows\system32\1761131589
c:\windows\system32\950594581
Folder::
c:\documents and settings\Me\Application Data\LimeWire
c:\progra~1\MYWEBS~1
DDS::
uSearchMigratedDefaultURL = hxxp://www.mywebsearch.com/jsp/cfg_redir2.jsp?id=ZNxmk572YYUS&fl=0&ptb=CU15EGtDfuo_BX.6DtQy9A&url=http://www.ask.com/web&q={searchTerms}&l=zn&o=sb
BHO: {098716A9-0310-4CBE-BD64-B790A9761158} - No File
EB: {2AA2FBF8-9C76-4E97-A226-25C5F4AB6358} - No File
Registry::
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"MyWebSearch Email Plugin"=-
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"MyWebSearch Email Plugin"=-
"My Web Search Bar Search Scope Monitor"=-
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000000
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000000
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000000



Save this as
CFScript

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine. This tool is not a toy and not for everyday use.

http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif

Close all browser windows and refering to the picture above, drag CFScript into ComboFix.exe. Let ComboFix update itself.
Then post the resultant log.



Uninstall vulnerable Flash versions by following instructions here (http://kb2.adobe.com/cps/141/tn_14157.html). Fresh version can be obtained here (http://get.adobe.com/flashplayer/).


Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update to the latest version...

Updating Java:

Download the latest version of Java Runtime Environment (JRE) 6 Update 17 (http://java.sun.com/javase/downloads/index.jsp).
Click the
Download
button to the right.
Select Windows on platform combobox and check the box that says:
Accept License Agreement. Click continue.

The page will refresh.
Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
Check any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u17-windows-i586-p.exe to install the newest version. Uncheck Carbonite online backup trial if it's offered there.



Download ATF (Atribune Temp File) Cleaner© by Atribune (http://www.atribune.org/ccount/click.php?id=1) to your desktop.

Double-click ATF Cleaner.exe to open it

Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache
*The other boxes are optional*
Then click the Empty Selected button.

If you use Firefox:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

If you use Opera:
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Click Exit on the Main menu to close the program.


Please run an online scan with Kaspersky Online Scanner (http://www.kaspersky.com/kos/eng/partner/default/kavwebscan.html) as instructed in the screenshot here (http://i275.photobucket.com/albums/jj285/Bleeping/KAS/KAS9.gif).


Post back its report, a fresh dds.txt log and above mentioned ComboFix resultant log.

[ericl]

I do not see the file c:\windows\system32\expsrv32.dll

I do however see c:\windows\system32\expsrv.dll

I will wait for your reply to continue :)

Thanks again!

[Blade81]

Hi,

The file should be there unless it's hidden.

Show hidden files
-----------------
* Click Start.
* Open My Computer.
* Select the Tools menu and click Folder Options.
* Select the View Tab.
* Under the Hidden files and folders heading select Show hidden files and folders.
* Uncheck the Hide protected operating system files (recommended) option.
* Click Yes to confirm.
* Click OK.


See if you can find the file now. If not, let's skip over virustotal part.

[ericl]

Hi again...

Thanks so much for your help. I still couldnt see the .dll file even when showing hidden files. The combo fix and KAP files are posted below.


ComboFix 09-11-19.05 - Me 12/01/2009 16:09.3.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1270.730 [GMT -6:00]
Running from: c:\documents and settings\Me\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Me\Desktop\CFScript.txt
AV: Norton AntiVirus *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton AntiVirus *enabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}
.
- REDUCED FUNCTIONALITY MODE -
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
c:\documents and settings\Me\Application Data\LimeWire
c:\documents and settings\Me\Application Data\LimeWire\413splashfree.png
c:\documents and settings\Me\Application Data\LimeWire\createtimes.cache
c:\documents and settings\Me\Application Data\LimeWire\data.ser
c:\documents and settings\Me\Application Data\LimeWire\fileurns.bak
c:\documents and settings\Me\Application Data\LimeWire\fileurns.cache
c:\documents and settings\Me\Application Data\LimeWire\filters.props
c:\documents and settings\Me\Application Data\LimeWire\gnutella.net
c:\documents and settings\Me\Application Data\LimeWire\installation.props
c:\documents and settings\Me\Application Data\LimeWire\library.dat
c:\documents and settings\Me\Application Data\LimeWire\limewire.props
c:\documents and settings\Me\Application Data\LimeWire\pub1.key
c:\documents and settings\Me\Application Data\LimeWire\public.key
c:\documents and settings\Me\Application Data\LimeWire\questions.props
c:\documents and settings\Me\Application Data\LimeWire\responses.cache
c:\documents and settings\Me\Application Data\LimeWire\secureMessage.key
c:\documents and settings\Me\Application Data\LimeWire\simpp.xml
c:\documents and settings\Me\Application Data\LimeWire\spam.dat
c:\documents and settings\Me\Application Data\LimeWire\tables.props
c:\documents and settings\Me\Application Data\LimeWire\themes\360SharePro_theme.lwtp
c:\documents and settings\Me\Application Data\LimeWire\themes\360SharePro_theme\01_star.gif
c:\documents and settings\Me\Application Data\LimeWire\themes\360SharePro_theme\02_star.gif
c:\documents and settings\Me\Application Data\LimeWire\themes\360SharePro_theme\03_star.gif
c:\documents and settings\Me\Application Data\LimeWire\themes\360SharePro_theme\04_star.gif
c:\documents and settings\Me\Application Data\LimeWire\themes\360SharePro_theme\05_star.gif
c:\documents and settings\Me\Application Data\LimeWire\themes\360SharePro_theme\360share_banner.gif
c:\documents and settings\Me\Application Data\LimeWire\themes\360SharePro_theme\button1.gif
c:\documents and settings\Me\Application Data\LimeWire\themes\360SharePro_theme\button1_press.gif
c:\documents and settings\Me\Application Data\LimeWire\themes\360SharePro_theme\button2.gif
c:\documents and settings\Me\Application Data\LimeWire\themes\360SharePro_theme\button2_press.gif
c:\documents and settings\Me\Application Data\LimeWire\themes\360SharePro_theme\button3.gif
c:\documents and settings\Me\Application Data\LimeWire\themes\360SharePro_theme\button3_press.gif
c:\documents and settings\Me\Application Data\LimeWire\themes\360SharePro_theme\button4.gif
c:\documents and settings\Me\Application Data\LimeWire\themes\360SharePro_theme\button4_press.gif
c:\documents and settings\Me\Application Data\LimeWire\themes\360SharePro_theme\button5.gif
c:\documents and settings\Me\Application Data\LimeWire\themes\360SharePro_theme\button5_press.gif
c:\documents and settings\Me\Application Data\LimeWire\themes\360SharePro_theme\chat.gif
c:\documents and settings\Me\Application Data\LimeWire\themes\360SharePro_theme\dir_closed.gif
c:\documents and settings\Me\Application Data\LimeWire\themes\360SharePro_theme\dir_open.gif
c:\documents and settings\Me\Application Data\LimeWire\themes\360SharePro_theme\forward_dn.gif
c:\documents and settings\Me\Application Data\LimeWire\themes\360SharePro_theme\forward_up.gif
c:\documents and settings\Me\Application Data\LimeWire\themes\360SharePro_theme\kill.gif
c:\documents and settings\Me\Application Data\LimeWire\themes\360SharePro_theme\kill_on.gif
c:\documents and settings\Me\Application Data\LimeWire\themes\360SharePro_theme\lime.gif
c:\documents and settings\Me\Application Data\LimeWire\themes\360SharePro_theme\limeicon.gif
c:\documents and settings\Me\Application Data\LimeWire\themes\360SharePro_theme\logo.gif
c:\documents and settings\Me\Application Data\LimeWire\themes\360SharePro_theme\notsearching.gif
c:\documents and settings\Me\Application Data\LimeWire\themes\360SharePro_theme\pause_dn.gif
c:\documents and settings\Me\Application Data\LimeWire\themes\360SharePro_theme\pause_up.gif
c:\documents and settings\Me\Application Data\LimeWire\themes\360SharePro_theme\play_dn.gif
c:\documents and settings\Me\Application Data\LimeWire\themes\360SharePro_theme\play_up.gif
c:\documents and settings\Me\Application Data\LimeWire\themes\360SharePro_theme\question.gif
c:\documents and settings\Me\Application Data\LimeWire\themes\360SharePro_theme\rewind_dn.gif
c:\documents and settings\Me\Application Data\LimeWire\themes\360SharePro_theme\rewind_up.gif
c:\documents and settings\Me\Application Data\LimeWire\themes\360SharePro_theme\search.gif
c:\documents and settings\Me\Application Data\LimeWire\themes\360SharePro_theme\searching.gif
c:\documents and settings\Me\Application Data\LimeWire\themes\360SharePro_theme\splash.png
c:\documents and settings\Me\Application Data\LimeWire\themes\360SharePro_theme\splashpro.png
c:\documents and settings\Me\Application Data\LimeWire\themes\360SharePro_theme\stop_dn.gif
c:\documents and settings\Me\Application Data\LimeWire\themes\360SharePro_theme\stop_up.gif
c:\documents and settings\Me\Application Data\LimeWire\themes\360SharePro_theme\theme.txt
c:\documents and settings\Me\Application Data\LimeWire\themes\360SharePro_theme\warning.gif
c:\documents and settings\Me\Application Data\LimeWire\version.key
c:\documents and settings\Me\Application Data\LimeWire\version.xml
c:\documents and settings\Me\Application Data\LimeWire\xml\data\delete_me
c:\documents and settings\Me\Application Data\LimeWire\xml\misc\application.gif
c:\documents and settings\Me\Application Data\LimeWire\xml\misc\audio.gif
c:\documents and settings\Me\Application Data\LimeWire\xml\misc\document.gif
c:\documents and settings\Me\Application Data\LimeWire\xml\misc\image.gif
c:\documents and settings\Me\Application Data\LimeWire\xml\misc\video.gif
c:\documents and settings\Me\Application Data\LimeWire\xml\schemas\application.xsd
c:\documents and settings\Me\Application Data\LimeWire\xml\schemas\audio.xsd
c:\documents and settings\Me\Application Data\LimeWire\xml\schemas\document.xsd
c:\documents and settings\Me\Application Data\LimeWire\xml\schemas\image.xsd
c:\documents and settings\Me\Application Data\LimeWire\xml\schemas\video.xsd

.
((((((((((((((((((((((((( Files Created from 2009-11-01 to 2009-12-01 )))))))))))))))))))))))))))))))
.

2009-12-01 21:52 . 2009-08-22 06:37 165240 ----a-r- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\IPSFFPlgn\components\IPSFFPl.dll
2009-12-01 16:05 . 2009-09-22 08:00 259440 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091201.006\ECMSVR32.DLL
2009-12-01 16:05 . 2009-09-15 08:00 2747952 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091201.006\CCERASER.DLL
2009-12-01 16:05 . 2009-08-26 08:00 371248 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091201.006\EECTRL.SYS
2009-12-01 16:05 . 2009-08-26 08:00 102448 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091201.006\ERASER.SYS
2009-12-01 16:05 . 2009-08-25 08:00 84912 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091201.006\NAVENG.SYS
2009-12-01 16:05 . 2009-08-25 08:00 177520 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091201.006\NAVENG32.DLL
2009-12-01 16:05 . 2009-08-25 08:00 1647984 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091201.006\NAVEX32A.DLL
2009-12-01 16:05 . 2009-08-25 08:00 1323568 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091201.006\NAVEX15.SYS
2009-11-20 18:11 . 2009-11-20 18:11 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2009-11-20 18:11 . 2009-12-01 22:00 -------- d-----w- c:\documents and settings\Me\Application Data\skypePM
2009-11-20 18:09 . 2009-12-01 21:59 -------- d-----w- c:\documents and settings\Me\Application Data\Skype
2009-11-20 18:08 . 2009-11-20 18:08 -------- d-----w- c:\program files\Common Files\Skype
2009-11-20 18:08 . 2009-11-20 18:08 -------- d-----r- c:\program files\Skype
2009-11-20 18:08 . 2009-11-20 18:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2009-11-20 03:38 . 2009-11-20 03:39 -------- d-----w- c:\program files\ERUNT
2009-11-17 09:20 . 2009-11-17 09:26 -------- d-sh--w- c:\windows\system32\SysWoW32
2009-11-17 09:19 . 2009-11-17 09:25 -------- d-----w- c:\windows\system32\177900402
2009-11-12 21:05 . 2009-10-28 22:37 329592 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091111.001\IDSXpx86.sys
2009-11-12 21:05 . 2009-10-28 22:37 811896 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091111.001\Scxpx86.dll
2009-11-12 21:05 . 2009-10-28 22:37 488312 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091111.001\IDSxpx86.dll
2009-11-12 21:05 . 2009-10-28 22:37 343088 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091111.001\IDSvix86.sys
2009-11-12 21:05 . 2009-10-28 22:37 466992 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091111.001\IDSviA64.sys
2009-11-11 20:31 . 2009-10-28 22:37 329592 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091107.001\IDSXpx86.sys
2009-11-11 20:31 . 2009-10-28 22:37 811896 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091107.001\Scxpx86.dll
2009-11-11 20:31 . 2009-10-28 22:37 343088 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091107.001\IDSvix86.sys
2009-11-11 20:31 . 2009-10-28 22:37 488312 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091107.001\IDSxpx86.dll
2009-11-11 20:31 . 2009-10-28 22:37 466992 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091107.001\IDSviA64.sys
2009-11-06 18:57 . 2009-10-28 22:37 343088 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091105.001\IDSvix86.sys
2009-11-06 18:57 . 2009-10-28 22:37 329592 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091105.001\IDSXpx86.sys
2009-11-06 18:57 . 2009-10-28 22:37 811896 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091105.001\Scxpx86.dll
2009-11-06 18:57 . 2009-10-28 22:37 488312 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091105.001\IDSxpx86.dll
2009-11-06 18:57 . 2009-10-28 22:37 466992 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091105.001\IDSviA64.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-01 20:47 . 2006-07-05 23:35 94208 ----a-w- c:\windows\DUMPaece.tmp
2009-12-01 20:46 . 2006-07-05 23:35 94208 ----a-w- c:\windows\DUMPb13f.tmp
2009-12-01 02:25 . 2008-06-26 05:40 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2009-11-26 21:20 . 2009-10-24 07:39 236280 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-11-23 22:23 . 2008-04-24 18:20 -------- d-----w- c:\documents and settings\Me\Application Data\FileZilla
2009-11-20 18:11 . 2006-08-26 00:43 -------- d-----w- c:\program files\Google
2009-11-18 06:31 . 2009-11-18 06:31 0 ----a-w- c:\windows\system32\30.tmp
2009-11-18 06:31 . 2009-11-18 06:31 0 ----a-w- c:\windows\system32\2F.tmp
2009-11-17 09:18 . 2009-11-17 09:18 738816 --sha-w- c:\windows\system32\11F.tmp
2009-11-15 22:01 . 2009-09-11 05:41 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-11-14 20:18 . 2006-07-22 21:26 50776 ----a-w- c:\documents and settings\Me\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-07 02:22 . 2008-06-17 02:01 -------- d-----w- c:\documents and settings\Me\Application Data\gtk-2.0
2009-11-03 22:20 . 2009-02-18 02:40 664 ----a-w- c:\windows\system32\d3d9caps.dat
2009-10-29 20:11 . 2009-10-29 20:11 -------- d-----w- c:\program files\Microsoft Silverlight
2009-10-29 07:20 . 2009-10-29 07:20 -------- d-----w- c:\documents and settings\Me\Application Data\Mozilla-Cache
2009-10-29 07:20 . 2006-07-22 04:23 -------- d-----w- c:\program files\PartyGaming.Net
2009-10-29 07:06 . 2008-04-27 08:12 -------- d-----w- c:\program files\PartyGaming
2009-10-28 22:37 . 2009-10-28 22:37 343088 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\IDSvix86.sys
2009-10-28 22:37 . 2009-10-28 22:37 329592 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\IDSXpx86.sys
2009-10-28 22:37 . 2009-10-28 22:37 811896 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\Scxpx86.dll
2009-10-28 22:37 . 2009-10-28 22:37 488312 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\IDSxpx86.dll
2009-10-28 22:37 . 2009-10-28 22:37 466992 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\IDSviA64.sys
2009-10-22 20:12 . 2009-10-22 20:12 -------- d-----w- c:\program files\eBay
2009-10-13 23:21 . 2006-07-22 22:56 -------- d-----w- c:\program files\Common Files\Adobe
2009-10-11 07:00 . 2008-04-28 20:33 -------- d-----w- c:\documents and settings\Me\Application Data\Microgaming
2009-10-08 06:45 . 2008-10-13 03:22 -------- d-----w- c:\program files\Peter Drew
2009-09-24 19:10 . 2009-09-24 19:09 86016 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\arh.exe
2009-09-24 18:23 . 2009-01-13 03:07 68940 ----a-w- c:\windows\hpoins05.dat
2009-09-23 19:19 . 2009-09-23 19:19 49152 ----a-r- c:\windows\system32\inetwh32.dll
2009-09-23 19:19 . 2009-09-23 19:19 1044480 ----a-r- c:\windows\system32\roboex32.dll
2009-09-18 08:13 . 2009-09-18 08:13 8302 ----a-r- c:\documents and settings\Me\Application Data\Microsoft\Installer\{FAB88294-6EE7-4F83-9097-8E7819724EF8}\_784BC2CC2DBADFC11854EC.exe
2009-09-18 08:13 . 2009-09-18 08:13 8302 ----a-r- c:\documents and settings\Me\Application Data\Microsoft\Installer\{FAB88294-6EE7-4F83-9097-8E7819724EF8}\_5C61E917AB8C8724D932D5.exe
2009-09-18 08:13 . 2009-09-18 08:13 8302 ----a-r- c:\documents and settings\Me\Application Data\Microsoft\Installer\{FAB88294-6EE7-4F83-9097-8E7819724EF8}\_31A30127C2C6832B6BBA9D.exe
2009-09-18 08:13 . 2009-09-18 08:13 1406 ----a-r- c:\documents and settings\Me\Application Data\Microsoft\Installer\{FAB88294-6EE7-4F83-9097-8E7819724EF8}\_8EEE255E964F0BE8010286.exe
2009-09-18 08:13 . 2009-09-18 08:13 1406 ----a-r- c:\documents and settings\Me\Application Data\Microsoft\Installer\{FAB88294-6EE7-4F83-9097-8E7819724EF8}\_698165531D8150AEDAB23E.exe
2009-09-17 06:49 . 2009-09-17 06:49 1204224 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\m\multistagepickxofybonus.3a30a9c7b165f5e8a337ca88ed08906c.dll
2009-09-17 06:46 . 2009-09-17 06:46 860160 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\s\scoopthecashbonus.bba34ca69d484ca056b3150cf3511c31.dll
2009-09-17 06:45 . 2009-09-17 06:45 831488 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\r\racebonus.0a92bce3bdb7feb1970ec9894848e1ee.dll
2009-09-17 06:43 . 2009-09-17 06:43 1171456 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\w\wealthspa_stonebonus.884fe3f012cc21e9f4b94beccb344fe5.dll
2009-09-17 06:43 . 2009-09-17 06:43 1204224 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\w\wealthspa_bathbonus.eaf1477312e7ecb9b1c7aa0a26e6ac61.dll
2009-09-17 06:42 . 2009-09-17 06:42 1142784 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\w\wealthspa_bodywaxbonus.86b2e4bb4c8e68cbf84cdb6310c39218.dll
2009-09-17 06:41 . 2009-09-17 06:41 1290240 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\w\wealthspa_smoothiebonus.779ec9c8439f59a40852d4a998367c4f.dll
2009-09-17 06:40 . 2009-09-17 06:40 827392 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\p\playerinstantiatedchoosebonus.ceb25d7dda7b0effc207d3dec6e30288.dll
2009-09-17 06:39 . 2009-09-17 06:39 1196032 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\w\wealthspa_massagebonus.0e575cb178075b87da73199c7e3bdcc1.dll
2009-09-11 14:18 . 2004-08-04 12:00 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-11 01:07 . 2009-09-11 01:07 1024000 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\s\simplepickxofychoicebonus_summerholiday.2f3c0065ff052710ed0c13651e2571da.dll
2009-09-11 01:05 . 2009-09-11 01:05 679936 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\t\transition_septgao_09.04686bb06cfe59ecb3f271eb95218422.dll
2009-09-11 01:05 . 2009-09-11 01:05 679936 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\t\transition_wealthspa.5a3f4e96415d8b3050681cdd275f3d88.dll
2009-09-11 01:05 . 2009-09-11 01:05 1478656 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\a\advancedslots1_septgao_09.1d5fda158c9a9d1dcbf9e88c5355d884.dll
2009-09-11 01:05 . 2009-09-11 01:05 1032192 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\a\advancedslots1xxx_wealthspa.2cac89b1bff8f25a6a8d3748201af558.dll
2009-09-11 01:05 . 2009-09-11 01:05 1040384 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\a\advancedslots1xxx_septgao_09.02b3e0bc2a35757d7c030659fd21c70a.dll
2009-09-11 01:05 . 2009-09-11 01:05 1224704 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\a\advancedslots1xxx_summerholiday.ca5125cc93020b208c8104895ffd4a80.dll
2009-09-11 01:05 . 2009-09-11 01:05 1474560 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\a\advancedslots1_wealthspa.548276e787b133afb9b912eb95b8b5c5.dll
2009-09-11 01:05 . 2009-09-11 01:05 1638400 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\a\advancedslots1_summerholiday.19e3e7b6f28b2f036c0b87d00fc799b9.dll
2009-09-11 01:05 . 2009-09-11 01:05 618496 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\g\gamble2_wealthspa.a58c586ab4d974ea2d4142fb4d851c2b.dll
2009-09-11 01:05 . 2009-09-11 01:05 618496 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\g\gamble2_septgao_09.d8cd6b206ce4b18e0867e42785806a63.dll
2009-09-11 01:05 . 2009-09-11 01:05 606208 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\g\gamble2_summerholiday.b02744e18c4cdb3dd3394f69d8987073.dll
2009-09-11 00:36 . 2009-09-11 00:36 417792 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\m\menucore.e2df50a5930ba5d46a68f5564d204ba0.dll
2009-09-07 19:50 . 2009-09-07 19:50 152576 ----a-w- c:\documents and settings\Me\Application Data\Sun\Java\jre1.6.0_15\lzma.dll
2009-09-04 21:03 . 2004-08-04 12:00 58880 ----a-w- c:\windows\system32\msasn1.dll
2007-11-09 21:25 . 2008-07-26 18:57 57344 ----a-w- c:\program files\mozilla firefox\components\MGSHelper.dll
2009-04-15 20:24 . 2009-04-15 20:24 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-04-15 20:24 . 2009-04-15 20:24 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

--- c:\windows\system32\1761131589 ---
Company: ------
File Description: ------
File Version: ------
Product Name: ------
Copyright: ------
Original Filename: ------
File size: 1293
Created time: 2009-11-17 09:26
Modified time: 2009-11-17 09:26
MD5: B06C9D3E0CAC9A5B5794C677D9E087FA
SHA1: 5BE9FDE472CAACC58F1F69F57F417AFA1A0CE915


--- c:\windows\system32\950594581 ---
Company: ------
File Description: ------
File Version: ------
Product Name: ------
Copyright: ------
Original Filename: ------
File size: 817
Created time: 2009-11-17 09:26
Modified time: 2009-11-17 09:29
MD5: B1DD8EAB51EE3005F6B18BF97B40577A
SHA1: 1C0BB8CF84BC114B75C58E65674717E398CD0F41

---- Directory of c:\windows\system32\177900402 ----


---- Directory of c:\windows\system32\SysWoW32 ----

2009-11-17 09:26 . 2009-11-17 09:26 116 --sha-w- c:\windows\system32\SysWoW32\wu1660073551v7.kwd
2009-11-17 09:26 . 2009-11-17 09:26 3 --sha-w- c:\windows\system32\SysWoW32\wu1660073551v6.kwd
2009-11-17 09:26 . 2009-11-17 09:26 177 --sha-w- c:\windows\system32\SysWoW32\wu1660073551v5.kwd
2009-11-17 09:26 . 2009-11-17 09:26 135 --sha-w- c:\windows\system32\SysWoW32\wu1660073551v4.kwd
2009-11-17 09:25 . 2009-11-17 09:25 157 --sha-w- c:\windows\system32\SysWoW32\mi1660073551v3.kwd
2009-11-17 09:25 . 2009-11-17 09:25 200 --sha-w- c:\windows\system32\SysWoW32\mi1660073551v2.kwd
2009-11-17 09:25 . 2009-11-17 09:25 214 --sha-w- c:\windows\system32\SysWoW32\mi1660073551v1.kwd
2009-11-17 09:25 . 2009-11-17 09:25 86 --sha-w- c:\windows\system32\SysWoW32\mi1660073551v0.kwd
2009-11-17 09:25 . 2009-11-14 23:11 5101457 ----a-w- c:\windows\system32\SysWoW32\wu1660073551v7
2009-11-17 09:24 . 2009-11-14 23:10 5846215 ----a-w- c:\windows\system32\SysWoW32\wu1660073551v6
2009-11-17 09:24 . 2009-11-14 23:10 5545150 ----a-w- c:\windows\system32\SysWoW32\wu1660073551v5
2009-11-17 09:23 . 2009-11-14 23:10 5159273 ----a-w- c:\windows\system32\SysWoW32\wu1660073551v4
2009-11-17 09:23 . 2009-11-14 23:07 809994 ----a-w- c:\windows\system32\SysWoW32\mi1660073551v3
2009-11-17 09:22 . 2009-11-14 23:06 808817 ----a-w- c:\windows\system32\SysWoW32\mi1660073551v2
2009-11-17 09:22 . 2009-11-14 23:06 817079 ----a-w- c:\windows\system32\SysWoW32\mi1660073551v1
2009-11-17 09:21 . 2009-11-14 23:05 828254 ----a-w- c:\windows\system32\SysWoW32\mi1660073551v0


((((((((((((((((((((((((((((( SnapShot@2009-11-20_05.37.18 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-12-01 21:57 . 2009-12-01 21:57 16384 c:\windows\Temp\Perflib_Perfdata_3ec.dat
+ 2009-12-01 21:57 . 2009-12-01 21:57 16384 c:\windows\Temp\Perflib_Perfdata_248.dat
+ 2007-01-29 08:58 . 2009-10-28 15:07 46080 c:\windows\system32\tzchange.exe
- 2007-01-29 08:58 . 2009-07-14 11:03 46080 c:\windows\system32\tzchange.exe
+ 2009-11-25 09:02 . 2009-11-25 09:02 32768 c:\windows\Installer\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}\icon.exe
+ 2009-11-25 09:02 . 2009-11-25 09:02 429568 c:\windows\Installer\53af131.msi
+ 2009-11-20 21:17 . 2009-11-20 21:17 794112 c:\windows\Installer\18af0.msi
+ 2009-11-20 18:08 . 2009-11-20 18:08 371272 c:\windows\Installer\{D103C4BA-F905-437A-8049-DB24763BBE36}\SkypeIcon.exe
+ 2009-07-21 06:03 . 2009-07-21 06:03 1348432 c:\windows\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9876.0_x-ww_a621d1d5\msxml4.dll
+ 2008-08-30 01:30 . 2009-07-31 16:05 1372672 c:\windows\system32\msxml6.dll
+ 2009-07-21 06:05 . 2009-07-21 06:05 1348432 c:\windows\system32\msxml4.dll
+ 2004-08-04 12:00 . 2009-07-31 04:35 1172480 c:\windows\system32\msxml3.dll
+ 2008-08-30 01:30 . 2009-07-31 16:05 1372672 c:\windows\system32\dllcache\msxml6.dll
+ 2008-11-12 13:18 . 2009-07-31 04:35 1172480 c:\windows\system32\dllcache\msxml3.dll
+ 2009-11-20 18:08 . 2009-11-20 18:08 1565696 c:\windows\Installer\2b10404.msi
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-06-26 68856]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-10-09 25623336]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2005-02-08 159744]
"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2004-09-07 213054]
"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 110592]
"hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2004-12-08 790528]
"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifSvc.exe" [2008-01-29 583048]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2008-06-10 1406024]
"WatchDog"="c:\program files\InterVideo\DVD Check\DVDCheck.exe" [2004-12-09 184320]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-26 413696]
"AGRSMMSG"="AGRSMMSG.exe" - c:\windows\AGRSMMSG.exe [2005-04-13 88209]

c:\documents and settings\Me\Start Menu\Programs\Startup\AutorunsDisabled
hpqtra08.exe [2004-5-28 241664]
hpzinw12.exe [2004-9-29 61440]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
DVD Check.lnk - c:\program files\InterVideo\DVD Check\DVDCheck.exe [2006-7-6 184320]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\38a8ec15697]
[BU]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\__c00A2CC3]
[BU]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]
@="FSFilter Activity Monitor"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk.disabled]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk.disabled
backup=c:\windows\pss\HP Digital Imaging Monitor.lnk.disabledCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk.disabled]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk.disabled
backup=c:\windows\pss\HP Image Zone Fast Start.lnk.disabledCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Windows Search.lnk.disabled]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk.disabled
backup=c:\windows\pss\Windows Search.lnk.disabledCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Me^Start Menu^Programs^Startup^hpqtra08.exe]
path=c:\documents and settings\Me\Start Menu\Programs\Startup\hpqtra08.exe
backup=c:\windows\pss\hpqtra08.exeStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Me^Start Menu^Programs^Startup^HPZinw12.exe]
path=c:\documents and settings\Me\Start Menu\Programs\Startup\HPZinw12.exe
backup=c:\windows\pss\HPZinw12.exeStartup

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
"MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" /background
"YSearchProtection"=c:\program files\Yahoo!\Search Protection\SearchProtection.exe
"Search Protection"=c:\program files\Yahoo!\Search Protection\SearchProtection.exe
"ctfmon.exe"=c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe"
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
"PHIME2002ASync"=c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
"PHIME2002A"=c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
"KernelFaultCheck"=%systemroot%\system32\dumprep 0 -k
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe"
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe"
"WatchDog"=c:\program files\InterVideo\DVD Check\DVDCheck.exe
"SoundMAX"=c:\program files\Analog Devices\SoundMAX\Smax4.exe /tray
"SoundMAXPnP"=c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe"
"IgfxTray"=c:\windows\system32\igfxtray.exe
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"HotKeysCmds"=c:\windows\system32\hkcmd.exe
"eabconfg.cpl"=c:\program files\HPQ\Quick Launch Buttons\EabServr.exe /Start
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"MSConfig"=c:\windows\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\spoolsv.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\TEMP\\HP_WebRelease\\Setup\\HPZnet01.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\WINDOWS\\system32\\java.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NAV\1007020.00B\SymEFA.sys [8/31/2009 5:16 PM 310320]
R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\NAV\1007020.00B\BHDrvx86.sys [8/31/2009 5:16 PM 259632]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NAV\1007020.00B\cchpx86.sys [8/31/2009 5:04 PM 482432]
R1 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091111.001\IDSXpx86.sys [11/12/2009 3:05 PM 329592]
R2 Norton AntiVirus;Norton AntiVirus;c:\program files\Norton AntiVirus\Norton AntiVirus\Engine\16.7.2.11\ccSvcHst.exe [8/31/2009 5:15 PM 117640]
S2 gupdate1c9d517aa5a5782;Google Update Service (gupdate1c9d517aa5a5782);c:\program files\Google\Update\GoogleUpdate.exe [5/14/2009 10:43 PM 133104]

--- Other Services/Drivers In Memory ---

*Deregistered* - EraserUtilDrvI9
.
Contents of the 'Scheduled Tasks' folder

2009-11-27 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

2009-12-01 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-01-24 17:15]

2009-11-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-15 04:43]

2009-12-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-15 04:43]

2009-12-01 c:\windows\Tasks\SDMsgUpdate (TE).job
- c:\progra~1\SMARTD~1\Messages\SDNotify.exe [2009-01-30 12:29]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Search - ?p=ZNxmk572YYUS
IE: &Yahoo! Search - file:///c:\program files\Yahoo!\Common/ycsrch.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
IE: Yahoo! &Dictionary - file:///c:\program files\Yahoo!\Common/ycdict.htm
IE: Yahoo! &Maps - file:///c:\program files\Yahoo!\Common/ycmap.htm
IE: Yahoo! &SMS - file:///c:\program files\Yahoo!\Common/ycsms.htm
IE: {{17709D14-4A02-42c6-B9FA-18C90A851F51} - c:\microgaming\Poker\wildjackMPP\MPPoker.exe
FF - ProfilePath - c:\documents and settings\Me\Application Data\Mozilla\Firefox\Profiles\hscmsm06.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-yma4&p=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - prefs.js: keyword.URL - hxxp://recovery.alexa.com/helper/?aid=VFEJa11Fhm00oF&plugin=spkyf-1.4.7&reason=keyword&location=
FF - component: c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\IPSFFPlgn\components\IPSFFPl.dll
FF - component: c:\documents and settings\Me\Application Data\Mozilla\Firefox\Profiles\hscmsm06.default\extensions\{7104ec46-5dfb-4609-84f0-915970e383d7}\components\FFExternalAlert.dll
FF - component: c:\program files\Google\Google Gears\Firefox\lib\ff35\gears.dll
FF - component: c:\program files\Mozilla Firefox\components\MGSHelper.dll
FF - plugin: c:\documents and settings\Me\Local Settings\Application Data\Yahoo!\BrowserPlus\2.4.21\Plugins\npybrowserplus_2.4.21.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npqtplugin8.dll
FF - plugin: c:\program files\QuickTime\Plugins\npqtplugin8.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
FF - plugin: c:\program files\XStandard\Bin\NPXStandard.dll

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-01 16:12
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe????????0?4?1?0??P???? ???B???????????????B? ??????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Norton AntiVirus]
"ImagePath"="\"c:\program files\Norton AntiVirus\Norton AntiVirus\Engine\16.7.2.11\ccSvcHst.exe\" /s \"Norton AntiVirus\" /m \"c:\program files\Norton AntiVirus\Norton AntiVirus\Engine\16.7.2.11\diMaster.dll\" /prefetch:1"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1679765361-3058041043-3763034360-1006\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3552)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2009-12-01 16:27
ComboFix-quarantined-files.txt 2009-12-01 22:27
ComboFix2.txt 2009-11-20 05:52

Pre-Run: 66,924,965,888 bytes free
Post-Run: 66,905,554,944 bytes free

- - End Of File - - B89B79652C184ACBFD1BB9424BFD7116


--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0: scan report
Wednesday, December 2, 2009
Operating system: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Wednesday, December 02, 2009 21:49:32
Records in database: 3323855
--------------------------------------------------------------------------------

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
C:\
D:\

Scan statistics:
Objects scanned: 186492
Threats found: 19
Infected objects found: 41
Suspicious objects found: 0
Scan duration: 05:08:59


File name / Threat / Threats count
C:\Documents and Settings\Me\My Documents\Eric's Stuff\petesfreeebooks1\easyebookmoneyreseller_14.zip Infected: not-a-virus:Downloader.Win32.Agent.db 2
C:\Documents and Settings\Me\My Documents\SUPERILLEGALDOWNLOADS\million dollar licensing.patched.by.DBC\patch.by.DBC.exe Infected: Trojan.Win32.Delf.rkn 1
C:\Documents and Settings\Me\My Documents\SUPERILLEGALDOWNLOADS\million dollar licensing.patched.by.DBC.zip Infected: Trojan.Win32.Delf.rkn 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\dpnlobby32.dll.vir Infected: Trojan.Win32.Delf.rkn 1
C:\System Volume Information\_restore{600CA968-24BB-4AD4-ABA5-E482E234FBDC}\RP872\A0104260.dll Infected: not-a-virus:WebToolbar.Win32.Zango.bd 1
C:\System Volume Information\_restore{600CA968-24BB-4AD4-ABA5-E482E234FBDC}\RP872\A0104262.dll Infected: not-a-virus:AdWare.Win32.HotBar.ck 1
C:\System Volume Information\_restore{600CA968-24BB-4AD4-ABA5-E482E234FBDC}\RP872\A0104265.dll Infected: not-a-virus:AdWare.Win32.HotBar.ck 1
C:\System Volume Information\_restore{600CA968-24BB-4AD4-ABA5-E482E234FBDC}\RP872\A0104272.dll Infected: not-a-virus:WebToolbar.Win32.MyWebSearch.au 1
C:\System Volume Information\_restore{600CA968-24BB-4AD4-ABA5-E482E234FBDC}\RP872\A0104273.scr Infected: not-a-virus:WebToolbar.Win32.MyWebSearch 1
C:\System Volume Information\_restore{600CA968-24BB-4AD4-ABA5-E482E234FBDC}\RP872\A0104274.DLL Infected: not-a-virus:WebToolbar.Win32.MyWebSearch 1
C:\System Volume Information\_restore{600CA968-24BB-4AD4-ABA5-E482E234FBDC}\RP872\A0104275.EXE Infected: not-a-virus:WebToolbar.Win32.MyWebSearch.au 1
C:\System Volume Information\_restore{600CA968-24BB-4AD4-ABA5-E482E234FBDC}\RP872\A0104276.DLL Infected: not-a-virus:WebToolbar.Win32.MyWebSearch.at 1
C:\System Volume Information\_restore{600CA968-24BB-4AD4-ABA5-E482E234FBDC}\RP872\A0104278.DLL Infected: not-a-virus:WebToolbar.Win32.MyWebSearch.bc 1
C:\System Volume Information\_restore{600CA968-24BB-4AD4-ABA5-E482E234FBDC}\RP872\A0104279.DLL Infected: not-a-virus:WebToolbar.Win32.MyWebSearch 1
C:\System Volume Information\_restore{600CA968-24BB-4AD4-ABA5-E482E234FBDC}\RP872\A0104280.DLL Infected: not-a-virus:WebToolbar.Win32.MyWebSearch.l 1
C:\System Volume Information\_restore{600CA968-24BB-4AD4-ABA5-E482E234FBDC}\RP872\A0104281.DLL Infected: not-a-virus:WebToolbar.Win32.MyWebSearch.af 1
C:\System Volume Information\_restore{600CA968-24BB-4AD4-ABA5-E482E234FBDC}\RP872\A0104282.DLL Infected: not-a-virus:WebToolbar.Win32.MyWebSearch.au 1
C:\System Volume Information\_restore{600CA968-24BB-4AD4-ABA5-E482E234FBDC}\RP872\A0104283.DLL Infected: not-a-virus:WebToolbar.Win32.MyWebSearch.au 1
C:\System Volume Information\_restore{600CA968-24BB-4AD4-ABA5-E482E234FBDC}\RP872\A0104284.SCR Infected: not-a-virus:WebToolbar.Win32.MyWebSearch 1
C:\System Volume Information\_restore{600CA968-24BB-4AD4-ABA5-E482E234FBDC}\RP872\A0104285.DLL Infected: not-a-virus:WebToolbar.Win32.MyWebSearch.au 1
C:\System Volume Information\_restore{600CA968-24BB-4AD4-ABA5-E482E234FBDC}\RP872\A0104286.DLL Infected: not-a-virus:WebToolbar.Win32.MyWebSearch 1
C:\System Volume Information\_restore{600CA968-24BB-4AD4-ABA5-E482E234FBDC}\RP872\A0104287.EXE Infected: not-a-virus:WebToolbar.Win32.MyWebSearch.a 1
C:\System Volume Information\_restore{600CA968-24BB-4AD4-ABA5-E482E234FBDC}\RP872\A0104288.DLL Infected: not-a-virus:WebToolbar.Win32.MyWebSearch.an 1
C:\System Volume Information\_restore{600CA968-24BB-4AD4-ABA5-E482E234FBDC}\RP872\A0104289.DLL Infected: not-a-virus:WebToolbar.Win32.MyWebSearch.aq 1
C:\System Volume Information\_restore{600CA968-24BB-4AD4-ABA5-E482E234FBDC}\RP872\A0104290.DLL Infected: not-a-virus:Monitor.Win32.Agent.c 1
C:\System Volume Information\_restore{600CA968-24BB-4AD4-ABA5-E482E234FBDC}\RP872\A0104292.DLL Infected: not-a-virus:WebToolbar.Win32.MyWebSearch.bc 1
C:\System Volume Information\_restore{600CA968-24BB-4AD4-ABA5-E482E234FBDC}\RP872\A0104293.DLL Infected: not-a-virus:WebToolbar.Win32.MyWebSearch.ax 1
C:\System Volume Information\_restore{600CA968-24BB-4AD4-ABA5-E482E234FBDC}\RP872\A0104295.DLL Infected: not-a-virus:WebToolbar.Win32.MyWebSearch.at 1
C:\System Volume Information\_restore{600CA968-24BB-4AD4-ABA5-E482E234FBDC}\RP872\A0104297.DLL Infected: not-a-virus:WebToolbar.Win32.MyWebSearch 1
C:\System Volume Information\_restore{600CA968-24BB-4AD4-ABA5-E482E234FBDC}\RP872\A0104298.DLL Infected: not-a-virus:WebToolbar.Win32.MyWebSearch.as 1
C:\System Volume Information\_restore{600CA968-24BB-4AD4-ABA5-E482E234FBDC}\RP872\A0104301.EXE Infected: not-a-virus:WebToolbar.Win32.MyWebSearch.au 1
C:\System Volume Information\_restore{600CA968-24BB-4AD4-ABA5-E482E234FBDC}\RP872\A0104302.DLL Infected: not-a-virus:WebToolbar.Win32.MyWebSearch.ba 1
C:\System Volume Information\_restore{600CA968-24BB-4AD4-ABA5-E482E234FBDC}\RP872\A0104303.DLL Infected: not-a-virus:WebToolbar.Win32.MyWebSearch.au 1
C:\System Volume Information\_restore{600CA968-24BB-4AD4-ABA5-E482E234FBDC}\RP872\A0104304.DLL Infected: not-a-virus:WebToolbar.Win32.MyWebSearch.i 1
C:\System Volume Information\_restore{600CA968-24BB-4AD4-ABA5-E482E234FBDC}\RP872\A0104306.DLL Infected: not-a-virus:WebToolbar.Win32.MyWebSearch.as 1
C:\System Volume Information\_restore{600CA968-24BB-4AD4-ABA5-E482E234FBDC}\RP872\A0104307.EXE Infected: not-a-virus:WebToolbar.Win32.MyWebSearch 1
C:\WINDOWS\system32\SysWoW32\wu1660073551v4 Infected: Trojan-Downloader.WMA.GetCodec.s 1
C:\WINDOWS\system32\SysWoW32\wu1660073551v5 Infected: Trojan-Downloader.WMA.GetCodec.s 1
C:\WINDOWS\system32\SysWoW32\wu1660073551v6 Infected: Trojan-Downloader.WMA.GetCodec.s 1
C:\WINDOWS\system32\SysWoW32\wu1660073551v7 Infected: Trojan-Downloader.WMA.GetCodec.s 1

Selected area has been scanned.

[Blade81]

Ok. This latest log didn't have the dll either.

Open notepad and copy/paste the text in the quotebox below into it:



File::
C:\Documents and Settings\Me\My Documents\Eric's Stuff\petesfreeebooks1\easyebookmoneyreseller_14.zip
C:\Documents and Settings\Me\My Documents\SUPERILLEGALDOWNLOADS\million dollar licensing.patched.by.DBC.zip
c:\windows\system32\1761131589
c:\windows\system32\950594581
Folder::
C:\Documents and Settings\Me\My Documents\SUPERILLEGALDOWNLOADS\million dollar licensing.patched.by.DBC
C:\WINDOWS\system32\SysWoW32
c:\windows\system32\177900402
Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\38a8ec15697]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\__c00A2CC3]



Save this as
CFScript

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine. This tool is not a toy and not for everyday use.

http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif

Close all browser windows and refering to the picture above, drag CFScript into ComboFix.exe
Then post the resultant log. How's the system running?

[ericl]

Here's the new log below... the system seems to be running ok. The main issue though is when I search in google and click a result, I get hijacked to another page still. Other than that the system seems to be running fine besides a moderately slow wireless connection :)



ComboFix 09-11-19.05 - Me 12/04/2009 0:24.4.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1270.682 [GMT -6:00]
Running from: c:\documents and settings\Me\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Me\Desktop\CFScript.txt
AV: Norton AntiVirus *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton AntiVirus *enabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}
.
- REDUCED FUNCTIONALITY MODE -

FILE ::
"c:\documents and settings\Me\My Documents\Eric's Stuff\petesfreeebooks1\easyebookmoneyreseller_14.zip"
"c:\documents and settings\Me\My Documents\SUPERILLEGALDOWNLOADS\million dollar licensing.patched.by.DBC.zip"
"c:\windows\system32\1761131589"
"c:\windows\system32\950594581"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Me\My Documents\Eric's Stuff\petesfreeebooks1\easyebookmoneyreseller_14.zip
c:\documents and settings\Me\My Documents\SUPERILLEGALDOWNLOADS\million dollar licensing.patched.by.DBC
c:\documents and settings\Me\My Documents\SUPERILLEGALDOWNLOADS\million dollar licensing.patched.by.DBC.zip
c:\documents and settings\Me\My Documents\SUPERILLEGALDOWNLOADS\million dollar licensing.patched.by.DBC\Dbc.nfo
c:\documents and settings\Me\My Documents\SUPERILLEGALDOWNLOADS\million dollar licensing.patched.by.DBC\dni.nfo
c:\documents and settings\Me\My Documents\SUPERILLEGALDOWNLOADS\million dollar licensing.patched.by.DBC\file_id.diz
c:\documents and settings\Me\My Documents\SUPERILLEGALDOWNLOADS\million dollar licensing.patched.by.DBC\patch.by.DBC.exe
c:\windows\system32\1761131589
c:\windows\system32\950594581
c:\windows\system32\SysWoW32
c:\windows\system32\SysWoW32\mi1660073551v0
c:\windows\system32\SysWoW32\mi1660073551v0.kwd
c:\windows\system32\SysWoW32\mi1660073551v1
c:\windows\system32\SysWoW32\mi1660073551v1.kwd
c:\windows\system32\SysWoW32\mi1660073551v2
c:\windows\system32\SysWoW32\mi1660073551v2.kwd
c:\windows\system32\SysWoW32\mi1660073551v3
c:\windows\system32\SysWoW32\mi1660073551v3.kwd
c:\windows\system32\SysWoW32\wu1660073551v4
c:\windows\system32\SysWoW32\wu1660073551v4.kwd
c:\windows\system32\SysWoW32\wu1660073551v5
c:\windows\system32\SysWoW32\wu1660073551v5.kwd
c:\windows\system32\SysWoW32\wu1660073551v6
c:\windows\system32\SysWoW32\wu1660073551v6.kwd
c:\windows\system32\SysWoW32\wu1660073551v7
c:\windows\system32\SysWoW32\wu1660073551v7.kwd

.
((((((((((((((((((((((((( Files Created from 2009-11-04 to 2009-12-04 )))))))))))))))))))))))))))))))
.

2009-12-03 17:01 . 2009-09-22 08:00 259440 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091203.004\ECMSVR32.DLL
2009-12-03 17:01 . 2009-09-15 08:00 2747952 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091203.004\CCERASER.DLL
2009-12-03 17:01 . 2009-08-26 08:00 371248 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091203.004\EECTRL.SYS
2009-12-03 17:01 . 2009-08-26 08:00 102448 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091203.004\ERASER.SYS
2009-12-03 17:01 . 2009-08-25 08:00 84912 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091203.004\NAVENG.SYS
2009-12-03 17:01 . 2009-08-25 08:00 177520 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091203.004\NAVENG32.DLL
2009-12-03 17:01 . 2009-08-25 08:00 1647984 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091203.004\NAVEX32A.DLL
2009-12-03 17:01 . 2009-08-25 08:00 1323568 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091203.004\NAVEX15.SYS
2009-12-03 06:25 . 2009-08-22 06:37 165240 ----a-r- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\IPSFFPlgn\components\IPSFFPl.dll
2009-12-02 02:05 . 2009-12-02 02:05 152576 ----a-w- c:\documents and settings\Me\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2009-12-02 02:04 . 2009-12-02 02:04 79488 ----a-w- c:\documents and settings\Me\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2009-12-02 00:39 . 2009-12-02 00:39 -------- d-----w- C:\Sun
2009-11-20 18:11 . 2009-11-20 18:11 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2009-11-20 18:11 . 2009-12-04 06:00 -------- d-----w- c:\documents and settings\Me\Application Data\skypePM
2009-11-20 18:09 . 2009-12-04 06:23 -------- d-----w- c:\documents and settings\Me\Application Data\Skype
2009-11-20 18:08 . 2009-11-20 18:08 -------- d-----w- c:\program files\Common Files\Skype
2009-11-20 18:08 . 2009-11-20 18:08 -------- d-----r- c:\program files\Skype
2009-11-20 18:08 . 2009-11-20 18:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2009-11-20 03:38 . 2009-11-20 03:39 -------- d-----w- c:\program files\ERUNT
2009-11-17 09:19 . 2009-11-17 09:25 -------- d-----w- c:\windows\system32\177900402
2009-11-12 21:05 . 2009-10-28 22:37 329592 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091111.001\IDSXpx86.sys
2009-11-12 21:05 . 2009-10-28 22:37 811896 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091111.001\Scxpx86.dll
2009-11-12 21:05 . 2009-10-28 22:37 488312 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091111.001\IDSxpx86.dll
2009-11-12 21:05 . 2009-10-28 22:37 343088 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091111.001\IDSvix86.sys
2009-11-12 21:05 . 2009-10-28 22:37 466992 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091111.001\IDSviA64.sys
2009-11-11 20:31 . 2009-10-28 22:37 329592 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091107.001\IDSXpx86.sys
2009-11-11 20:31 . 2009-10-28 22:37 811896 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091107.001\Scxpx86.dll
2009-11-11 20:31 . 2009-10-28 22:37 343088 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091107.001\IDSvix86.sys
2009-11-11 20:31 . 2009-10-28 22:37 488312 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091107.001\IDSxpx86.dll
2009-11-11 20:31 . 2009-10-28 22:37 466992 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091107.001\IDSviA64.sys
2009-11-06 18:57 . 2009-10-28 22:37 343088 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091105.001\IDSvix86.sys
2009-11-06 18:57 . 2009-10-28 22:37 329592 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091105.001\IDSXpx86.sys
2009-11-06 18:57 . 2009-10-28 22:37 811896 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091105.001\Scxpx86.dll
2009-11-06 18:57 . 2009-10-28 22:37 488312 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091105.001\IDSxpx86.dll
2009-11-06 18:57 . 2009-10-28 22:37 466992 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091105.001\IDSviA64.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-04 05:28 . 2008-06-26 05:40 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2009-12-02 09:13 . 2006-08-26 00:43 -------- d-----w- c:\program files\Google
2009-12-02 02:07 . 2009-02-24 00:31 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-12-02 01:36 . 2009-09-24 19:09 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2009-12-02 00:24 . 2006-07-05 23:35 94208 ----a-w- c:\windows\DUMPb3a0.tmp
2009-12-02 00:21 . 2006-07-05 23:35 94208 ----a-w- c:\windows\DUMPaf2b.tmp
2009-12-02 00:19 . 2006-07-05 23:35 94208 ----a-w- c:\windows\DUMPb219.tmp
2009-12-02 00:10 . 2006-07-06 07:41 -------- d-----w- c:\program files\Java
2009-12-01 20:47 . 2006-07-05 23:35 94208 ----a-w- c:\windows\DUMPaece.tmp
2009-12-01 20:46 . 2006-07-05 23:35 94208 ----a-w- c:\windows\DUMPb13f.tmp
2009-11-26 21:20 . 2009-10-24 07:39 236280 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-11-23 22:23 . 2008-04-24 18:20 -------- d-----w- c:\documents and settings\Me\Application Data\FileZilla
2009-11-18 06:31 . 2009-11-18 06:31 0 ----a-w- c:\windows\system32\30.tmp
2009-11-18 06:31 . 2009-11-18 06:31 0 ----a-w- c:\windows\system32\2F.tmp
2009-11-17 09:18 . 2009-11-17 09:18 738816 --sha-w- c:\windows\system32\11F.tmp
2009-11-15 22:01 . 2009-09-11 05:41 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-11-14 20:18 . 2006-07-22 21:26 50776 ----a-w- c:\documents and settings\Me\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-07 02:22 . 2008-06-17 02:01 -------- d-----w- c:\documents and settings\Me\Application Data\gtk-2.0
2009-11-03 22:20 . 2009-02-18 02:40 664 ----a-w- c:\windows\system32\d3d9caps.dat
2009-10-29 20:11 . 2009-10-29 20:11 -------- d-----w- c:\program files\Microsoft Silverlight
2009-10-29 07:20 . 2009-10-29 07:20 -------- d-----w- c:\documents and settings\Me\Application Data\Mozilla-Cache
2009-10-29 07:20 . 2006-07-22 04:23 -------- d-----w- c:\program files\PartyGaming.Net
2009-10-29 07:06 . 2008-04-27 08:12 -------- d-----w- c:\program files\PartyGaming
2009-10-28 22:37 . 2009-10-28 22:37 343088 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\IDSvix86.sys
2009-10-28 22:37 . 2009-10-28 22:37 329592 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\IDSXpx86.sys
2009-10-28 22:37 . 2009-10-28 22:37 811896 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\Scxpx86.dll
2009-10-28 22:37 . 2009-10-28 22:37 488312 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\IDSxpx86.dll
2009-10-28 22:37 . 2009-10-28 22:37 466992 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\IDSviA64.sys
2009-10-22 20:12 . 2009-10-22 20:12 -------- d-----w- c:\program files\eBay
2009-10-13 23:21 . 2006-07-22 22:56 -------- d-----w- c:\program files\Common Files\Adobe
2009-10-11 07:00 . 2008-04-28 20:33 -------- d-----w- c:\documents and settings\Me\Application Data\Microgaming
2009-10-08 06:45 . 2008-10-13 03:22 -------- d-----w- c:\program files\Peter Drew
2009-09-24 19:10 . 2009-09-24 19:09 86016 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\arh.exe
2009-09-24 18:23 . 2009-01-13 03:07 68940 ----a-w- c:\windows\hpoins05.dat
2009-09-23 19:19 . 2009-09-23 19:19 49152 ----a-r- c:\windows\system32\inetwh32.dll
2009-09-23 19:19 . 2009-09-23 19:19 1044480 ----a-r- c:\windows\system32\roboex32.dll
2009-09-18 08:13 . 2009-09-18 08:13 8302 ----a-r- c:\documents and settings\Me\Application Data\Microsoft\Installer\{FAB88294-6EE7-4F83-9097-8E7819724EF8}\_784BC2CC2DBADFC11854EC.exe
2009-09-18 08:13 . 2009-09-18 08:13 8302 ----a-r- c:\documents and settings\Me\Application Data\Microsoft\Installer\{FAB88294-6EE7-4F83-9097-8E7819724EF8}\_5C61E917AB8C8724D932D5.exe
2009-09-18 08:13 . 2009-09-18 08:13 8302 ----a-r- c:\documents and settings\Me\Application Data\Microsoft\Installer\{FAB88294-6EE7-4F83-9097-8E7819724EF8}\_31A30127C2C6832B6BBA9D.exe
2009-09-18 08:13 . 2009-09-18 08:13 1406 ----a-r- c:\documents and settings\Me\Application Data\Microsoft\Installer\{FAB88294-6EE7-4F83-9097-8E7819724EF8}\_8EEE255E964F0BE8010286.exe
2009-09-18 08:13 . 2009-09-18 08:13 1406 ----a-r- c:\documents and settings\Me\Application Data\Microsoft\Installer\{FAB88294-6EE7-4F83-9097-8E7819724EF8}\_698165531D8150AEDAB23E.exe
2009-09-17 06:49 . 2009-09-17 06:49 1204224 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\m\multistagepickxofybonus.3a30a9c7b165f5e8a337ca88ed08906c.dll
2009-09-17 06:46 . 2009-09-17 06:46 860160 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\s\scoopthecashbonus.bba34ca69d484ca056b3150cf3511c31.dll
2009-09-17 06:45 . 2009-09-17 06:45 831488 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\r\racebonus.0a92bce3bdb7feb1970ec9894848e1ee.dll
2009-09-17 06:43 . 2009-09-17 06:43 1171456 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\w\wealthspa_stonebonus.884fe3f012cc21e9f4b94beccb344fe5.dll
2009-09-17 06:43 . 2009-09-17 06:43 1204224 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\w\wealthspa_bathbonus.eaf1477312e7ecb9b1c7aa0a26e6ac61.dll
2009-09-17 06:42 . 2009-09-17 06:42 1142784 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\w\wealthspa_bodywaxbonus.86b2e4bb4c8e68cbf84cdb6310c39218.dll
2009-09-17 06:41 . 2009-09-17 06:41 1290240 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\w\wealthspa_smoothiebonus.779ec9c8439f59a40852d4a998367c4f.dll
2009-09-17 06:40 . 2009-09-17 06:40 827392 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\p\playerinstantiatedchoosebonus.ceb25d7dda7b0effc207d3dec6e30288.dll
2009-09-17 06:39 . 2009-09-17 06:39 1196032 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\w\wealthspa_massagebonus.0e575cb178075b87da73199c7e3bdcc1.dll
2009-09-11 14:18 . 2004-08-04 12:00 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-11 01:07 . 2009-09-11 01:07 1024000 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\s\simplepickxofychoicebonus_summerholiday.2f3c0065ff052710ed0c13651e2571da.dll
2009-09-11 01:05 . 2009-09-11 01:05 679936 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\t\transition_septgao_09.04686bb06cfe59ecb3f271eb95218422.dll
2009-09-11 01:05 . 2009-09-11 01:05 679936 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\t\transition_wealthspa.5a3f4e96415d8b3050681cdd275f3d88.dll
2009-09-11 01:05 . 2009-09-11 01:05 1478656 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\a\advancedslots1_septgao_09.1d5fda158c9a9d1dcbf9e88c5355d884.dll
2009-09-11 01:05 . 2009-09-11 01:05 1032192 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\a\advancedslots1xxx_wealthspa.2cac89b1bff8f25a6a8d3748201af558.dll
2009-09-11 01:05 . 2009-09-11 01:05 1040384 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\a\advancedslots1xxx_septgao_09.02b3e0bc2a35757d7c030659fd21c70a.dll
2009-09-11 01:05 . 2009-09-11 01:05 1224704 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\a\advancedslots1xxx_summerholiday.ca5125cc93020b208c8104895ffd4a80.dll
2009-09-11 01:05 . 2009-09-11 01:05 1474560 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\a\advancedslots1_wealthspa.548276e787b133afb9b912eb95b8b5c5.dll
2009-09-11 01:05 . 2009-09-11 01:05 1638400 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\a\advancedslots1_summerholiday.19e3e7b6f28b2f036c0b87d00fc799b9.dll
2009-09-11 01:05 . 2009-09-11 01:05 618496 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\g\gamble2_wealthspa.a58c586ab4d974ea2d4142fb4d851c2b.dll
2009-09-11 01:05 . 2009-09-11 01:05 618496 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\g\gamble2_septgao_09.d8cd6b206ce4b18e0867e42785806a63.dll
2009-09-11 01:05 . 2009-09-11 01:05 606208 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\g\gamble2_summerholiday.b02744e18c4cdb3dd3394f69d8987073.dll
2009-09-11 00:36 . 2009-09-11 00:36 417792 ----a-w- c:\documents and settings\All Users\Application Data\MGS\cache\m\menucore.e2df50a5930ba5d46a68f5564d204ba0.dll
2009-09-07 19:50 . 2009-09-07 19:50 152576 ----a-w- c:\documents and settings\Me\Application Data\Sun\Java\jre1.6.0_15\lzma.dll
2007-11-09 21:25 . 2008-07-26 18:57 57344 ----a-w- c:\program files\mozilla firefox\components\MGSHelper.dll
2009-04-15 20:24 . 2009-04-15 20:24 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-04-15 20:24 . 2009-04-15 20:24 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-11-20_05.37.18 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-12-03 06:26 . 2009-12-03 06:26 16384 c:\windows\Temp\Perflib_Perfdata_6d0.dat
+ 2009-12-03 06:25 . 2009-12-03 06:25 16384 c:\windows\Temp\Perflib_Perfdata_380.dat
- 2007-01-29 08:58 . 2009-07-14 11:03 46080 c:\windows\system32\tzchange.exe
+ 2007-01-29 08:58 . 2009-10-28 15:07 46080 c:\windows\system32\tzchange.exe
+ 2009-12-02 01:20 . 2009-12-02 01:20 85173 c:\windows\system32\Macromed\Flash\uninstall_plugin.exe
+ 2009-11-25 09:02 . 2009-11-25 09:02 32768 c:\windows\Installer\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}\icon.exe
+ 2009-12-02 09:16 . 2009-12-02 09:16 25214 c:\windows\Installer\{9074AFC0-CFDA-11DE-B484-005056806466}\UNINST_Uninstall_G_F6A848FB884248E6A4CDCBDCF41F6A74_1.exe
+ 2009-12-02 09:16 . 2009-12-02 09:16 25214 c:\windows\Installer\{9074AFC0-CFDA-11DE-B484-005056806466}\UNINST_Uninstall_G_F6A848FB884248E6A4CDCBDCF41F6A74.exe
+ 2009-12-02 09:16 . 2009-12-02 09:16 25214 c:\windows\Installer\{9074AFC0-CFDA-11DE-B484-005056806466}\ShortcutOGL_EB071909B9884F8CBF3D6115D4ADEE5E.exe
+ 2009-12-02 09:16 . 2009-12-02 09:16 25214 c:\windows\Installer\{9074AFC0-CFDA-11DE-B484-005056806466}\ShortcutDX_EB071909B9884F8CBF3D6115D4ADEE5E.exe
+ 2009-12-02 09:16 . 2009-12-02 09:16 25214 c:\windows\Installer\{9074AFC0-CFDA-11DE-B484-005056806466}\googleearth.exe1_F6A848FB884248E6A4CDCBDCF41F6A74.exe
+ 2009-12-02 09:16 . 2009-12-02 09:16 25214 c:\windows\Installer\{9074AFC0-CFDA-11DE-B484-005056806466}\googleearth.exe_F6A848FB884248E6A4CDCBDCF41F6A74.exe
+ 2009-12-02 09:16 . 2009-12-02 09:16 25214 c:\windows\Installer\{9074AFC0-CFDA-11DE-B484-005056806466}\ARPPRODUCTICON.exe
- 2009-09-07 19:54 . 2009-07-25 10:23 149280 c:\windows\system32\javaws.exe
+ 2009-12-02 02:08 . 2009-12-02 02:07 149280 c:\windows\system32\javaws.exe
+ 2009-12-02 02:08 . 2009-12-02 02:07 145184 c:\windows\system32\javaw.exe
- 2009-09-07 19:54 . 2009-07-25 10:23 145184 c:\windows\system32\javaw.exe
+ 2009-12-02 02:08 . 2009-12-02 02:07 145184 c:\windows\system32\java.exe
- 2009-09-07 19:54 . 2009-07-25 10:23 145184 c:\windows\system32\java.exe
+ 2009-11-25 09:02 . 2009-11-25 09:02 429568 c:\windows\Installer\53af131.msi
+ 2009-12-02 02:07 . 2009-12-02 02:07 537600 c:\windows\Installer\1e0fff.msi
+ 2009-11-20 21:17 . 2009-11-20 21:17 794112 c:\windows\Installer\18af0.msi
+ 2009-11-20 18:08 . 2009-11-20 18:08 371272 c:\windows\Installer\{D103C4BA-F905-437A-8049-DB24763BBE36}\SkypeIcon.exe
+ 2009-07-21 06:03 . 2009-07-21 06:03 1348432 c:\windows\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9876.0_x-ww_a621d1d5\msxml4.dll
+ 2008-08-30 01:30 . 2009-07-31 16:05 1372672 c:\windows\system32\msxml6.dll
+ 2009-07-21 06:05 . 2009-07-21 06:05 1348432 c:\windows\system32\msxml4.dll
+ 2004-08-04 12:00 . 2009-07-31 04:35 1172480 c:\windows\system32\msxml3.dll
+ 2008-08-30 01:30 . 2009-07-31 16:05 1372672 c:\windows\system32\dllcache\msxml6.dll
+ 2008-11-12 13:18 . 2009-07-31 04:35 1172480 c:\windows\system32\dllcache\msxml3.dll
+ 2009-11-20 18:08 . 2009-11-20 18:08 1565696 c:\windows\Installer\2b10404.msi
+ 2009-12-02 09:16 . 2009-12-02 09:16 1258496 c:\windows\Installer\19aac48.msi
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-06-26 68856]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-10-09 25623336]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2005-02-08 159744]
"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2004-09-07 213054]
"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 110592]
"hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2004-12-08 790528]
"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifSvc.exe" [2008-01-29 583048]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2008-06-10 1406024]
"WatchDog"="c:\program files\InterVideo\DVD Check\DVDCheck.exe" [2004-12-09 184320]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-26 413696]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-12-02 149280]
"AGRSMMSG"="AGRSMMSG.exe" - c:\windows\AGRSMMSG.exe [2005-04-13 88209]

c:\documents and settings\Me\Start Menu\Programs\Startup\
SDK Tray Menu.lnk - c:\sun\SDK\jdk\bin\javaw.exe [2009-12-1 139264]

c:\documents and settings\Me\Start Menu\Programs\Startup\AutorunsDisabled
hpqtra08.exe [2004-5-28 241664]
hpzinw12.exe [2004-9-29 61440]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
DVD Check.lnk - c:\program files\InterVideo\DVD Check\DVDCheck.exe [2006-7-6 184320]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]
@="FSFilter Activity Monitor"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk.disabled]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk.disabled
backup=c:\windows\pss\HP Digital Imaging Monitor.lnk.disabledCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk.disabled]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk.disabled
backup=c:\windows\pss\HP Image Zone Fast Start.lnk.disabledCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Windows Search.lnk.disabled]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk.disabled
backup=c:\windows\pss\Windows Search.lnk.disabledCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Me^Start Menu^Programs^Startup^hpqtra08.exe]
path=c:\documents and settings\Me\Start Menu\Programs\Startup\hpqtra08.exe
backup=c:\windows\pss\hpqtra08.exeStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Me^Start Menu^Programs^Startup^HPZinw12.exe]
path=c:\documents and settings\Me\Start Menu\Programs\Startup\HPZinw12.exe
backup=c:\windows\pss\HPZinw12.exeStartup

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
"MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" /background
"YSearchProtection"=c:\program files\Yahoo!\Search Protection\SearchProtection.exe
"Search Protection"=c:\program files\Yahoo!\Search Protection\SearchProtection.exe
"ctfmon.exe"=c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe"
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
"PHIME2002ASync"=c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
"PHIME2002A"=c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
"KernelFaultCheck"=%systemroot%\system32\dumprep 0 -k
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe"
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe"
"WatchDog"=c:\program files\InterVideo\DVD Check\DVDCheck.exe
"SoundMAX"=c:\program files\Analog Devices\SoundMAX\Smax4.exe /tray
"SoundMAXPnP"=c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe"
"IgfxTray"=c:\windows\system32\igfxtray.exe
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"HotKeysCmds"=c:\windows\system32\hkcmd.exe
"eabconfg.cpl"=c:\program files\HPQ\Quick Launch Buttons\EabServr.exe /Start
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"MSConfig"=c:\windows\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\spoolsv.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\TEMP\\HP_WebRelease\\Setup\\HPZnet01.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\WINDOWS\\system32\\java.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Sun\\SDK\\jdk\\bin\\java.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NAV\1007020.00B\SymEFA.sys [8/31/2009 5:16 PM 310320]
R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\NAV\1007020.00B\BHDrvx86.sys [8/31/2009 5:16 PM 259632]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NAV\1007020.00B\cchpx86.sys [8/31/2009 5:04 PM 482432]
R1 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091111.001\IDSXpx86.sys [11/12/2009 3:05 PM 329592]
R2 Norton AntiVirus;Norton AntiVirus;c:\program files\Norton AntiVirus\Norton AntiVirus\Engine\16.7.2.11\ccSvcHst.exe [8/31/2009 5:15 PM 117640]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [12/1/2009 10:05 AM 102448]
S2 gupdate1c9d517aa5a5782;Google Update Service (gupdate1c9d517aa5a5782);c:\program files\Google\Update\GoogleUpdate.exe [5/14/2009 10:43 PM 133104]
.
Contents of the 'Scheduled Tasks' folder

2009-12-04 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

2009-12-04 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-01-24 17:15]

2009-11-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-15 04:43]

2009-12-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-15 04:43]

2009-12-03 c:\windows\Tasks\SDMsgUpdate (TE).job
- c:\progra~1\SMARTD~1\Messages\SDNotify.exe [2009-01-30 12:29]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Search - ?p=ZNxmk572YYUS
IE: &Yahoo! Search - file:///c:\program files\Yahoo!\Common/ycsrch.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
IE: Yahoo! &Dictionary - file:///c:\program files\Yahoo!\Common/ycdict.htm
IE: Yahoo! &Maps - file:///c:\program files\Yahoo!\Common/ycmap.htm
IE: Yahoo! &SMS - file:///c:\program files\Yahoo!\Common/ycsms.htm
IE: {{17709D14-4A02-42c6-B9FA-18C90A851F51} - c:\microgaming\Poker\wildjackMPP\MPPoker.exe
FF - ProfilePath - c:\documents and settings\Me\Application Data\Mozilla\Firefox\Profiles\hscmsm06.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-yma4&p=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - prefs.js: keyword.URL - hxxp://recovery.alexa.com/helper/?aid=VFEJa11Fhm00oF&plugin=spkyf-1.4.7&reason=keyword&location=
FF - component: c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\IPSFFPlgn\components\IPSFFPl.dll
FF - component: c:\documents and settings\Me\Application Data\Mozilla\Firefox\Profiles\hscmsm06.default\extensions\{7104ec46-5dfb-4609-84f0-915970e383d7}\components\FFExternalAlert.dll
FF - component: c:\program files\Google\Google Gears\Firefox\lib\ff35\gears.dll
FF - component: c:\program files\Mozilla Firefox\components\MGSHelper.dll
FF - plugin: c:\documents and settings\Me\Local Settings\Application Data\Yahoo!\BrowserPlus\2.4.21\Plugins\npybrowserplus_2.4.21.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npqtplugin8.dll
FF - plugin: c:\program files\QuickTime\Plugins\npqtplugin8.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
FF - plugin: c:\program files\XStandard\Bin\NPXStandard.dll

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-04 00:29
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe????????0?4?1?0??????? ???B???????????????B? ??????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Norton AntiVirus]
"ImagePath"="\"c:\program files\Norton AntiVirus\Norton AntiVirus\Engine\16.7.2.11\ccSvcHst.exe\" /s \"Norton AntiVirus\" /m \"c:\program files\Norton AntiVirus\Norton AntiVirus\Engine\16.7.2.11\diMaster.dll\" /prefetch:1"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1679765361-3058041043-3763034360-1006\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
Completion time: 2009-12-04 00:40
ComboFix-quarantined-files.txt 2009-12-04 06:40
ComboFix2.txt 2009-12-01 22:27
ComboFix3.txt 2009-11-20 05:52

Pre-Run: 66,148,261,888 bytes free
Post-Run: 66,223,140,864 bytes free

- - End Of File - - 3AEBB5955A5183889EEAE4FFC9C75D39

[Blade81]

Hi,

Did ComboFix request for a permission to update? Please run it again and let it update.

[ericl]

Updated combofix... It didn't ask me because when I disabled Norton, I also disconnected my wifi. So... all updated and here's the new log.


ComboFix 09-12-03.04 - Me 12/04/2009 3:44:06.5.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1270.380 [GMT -6:00]
Running from: C:\Documents and Settings\Me\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Me\Desktop\CFScript.txt
AV: Norton AntiVirus *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton AntiVirus *enabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}

FILE ::
"C:\Documents and Settings\Me\My Documents\Eric's Stuff\petesfreeebooks1\easyebookmoneyreseller_14.zip"
"C:\Documents and Settings\Me\My Documents\SUPERILLEGALDOWNLOADS\million dollar licensing.patched.by.DBC.zip"
"c:\windows\system32\1761131589"
"c:\windows\system32\950594581"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\177900402

.
((((((((((((((((((((((((( Files Created from 2009-11-04 to 2009-12-04 )))))))))))))))))))))))))))))))
.

2009-12-03 17:01:50 . 2009-09-22 08:00:00 259440 ----a-w- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091203.004\ECMSVR32.DLL
2009-12-03 17:01:50 . 2009-09-15 08:00:00 2747952 ----a-w- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091203.004\CCERASER.DLL
2009-12-03 17:01:50 . 2009-08-26 08:00:00 371248 ----a-w- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091203.004\EECTRL.SYS
2009-12-03 17:01:50 . 2009-08-26 08:00:00 102448 ----a-w- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091203.004\ERASER.SYS
2009-12-03 17:01:50 . 2009-08-25 08:00:00 84912 ----a-w- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091203.004\NAVENG.SYS
2009-12-03 17:01:50 . 2009-08-25 08:00:00 177520 ----a-w- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091203.004\NAVENG32.DLL
2009-12-03 17:01:50 . 2009-08-25 08:00:00 1647984 ----a-w- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091203.004\NAVEX32A.DLL
2009-12-03 17:01:50 . 2009-08-25 08:00:00 1323568 ----a-w- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091203.004\NAVEX15.SYS
2009-12-03 06:25:45 . 2009-08-22 06:37:14 165240 ----a-r- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\IPSFFPlgn\components\IPSFFPl.dll
2009-12-02 02:05:54 . 2009-12-02 02:05:54 152576 ----a-w- C:\Documents and Settings\Me\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2009-12-02 02:04:05 . 2009-12-02 02:04:05 79488 ----a-w- C:\Documents and Settings\Me\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2009-12-02 00:39:23 . 2009-12-02 00:39:23 0 d-----w- C:\Sun
2009-11-20 18:11:45 . 2009-11-20 18:11:45 56 ---ha-w- C:\WINDOWS\system32\ezsidmv.dat
2009-11-20 18:11:44 . 2009-12-04 06:00:42 0 d-----w- C:\Documents and Settings\Me\Application Data\skypePM
2009-11-20 18:09:33 . 2009-12-04 06:23:11 0 d-----w- C:\Documents and Settings\Me\Application Data\Skype
2009-11-20 18:08:26 . 2009-11-20 18:08:28 0 d-----w- C:\Program Files\Common Files\Skype
2009-11-20 18:08:19 . 2009-11-20 18:08:53 0 d-----r- C:\Program Files\Skype
2009-11-20 18:08:04 . 2009-11-20 18:08:18 0 d-----w- C:\Documents and Settings\All Users\Application Data\Skype
2009-11-20 03:38:55 . 2009-11-20 03:39:26 0 d-----w- C:\Program Files\ERUNT
2009-11-12 21:05:17 . 2009-10-28 22:37:22 329592 ----a-w- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091111.001\IDSXpx86.sys
2009-11-12 21:05:17 . 2009-10-28 22:37:21 811896 ----a-w- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091111.001\Scxpx86.dll
2009-11-12 21:05:17 . 2009-10-28 22:37:21 488312 ----a-w- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091111.001\IDSxpx86.dll
2009-11-12 21:05:16 . 2009-10-28 22:37:22 343088 ----a-w- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091111.001\IDSvix86.sys
2009-11-12 21:05:16 . 2009-10-28 22:37:21 466992 ----a-w- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091111.001\IDSviA64.sys
2009-11-11 20:31:53 . 2009-10-28 22:37:22 329592 ----a-w- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091107.001\IDSXpx86.sys
2009-11-11 20:31:53 . 2009-10-28 22:37:21 811896 ----a-w- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091107.001\Scxpx86.dll
2009-11-11 20:31:52 . 2009-10-28 22:37:22 343088 ----a-w- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091107.001\IDSvix86.sys
2009-11-11 20:31:52 . 2009-10-28 22:37:21 488312 ----a-w- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091107.001\IDSxpx86.dll
2009-11-11 20:31:52 . 2009-10-28 22:37:21 466992 ----a-w- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091107.001\IDSviA64.sys
2009-11-06 18:57:16 . 2009-10-28 22:37:22 343088 ----a-w- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091105.001\IDSvix86.sys
2009-11-06 18:57:16 . 2009-10-28 22:37:22 329592 ----a-w- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091105.001\IDSXpx86.sys
2009-11-06 18:57:16 . 2009-10-28 22:37:21 811896 ----a-w- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091105.001\Scxpx86.dll
2009-11-06 18:57:16 . 2009-10-28 22:37:21 488312 ----a-w- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091105.001\IDSxpx86.dll
2009-11-06 18:57:16 . 2009-10-28 22:37:21 466992 ----a-w- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091105.001\IDSviA64.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-04 05:28:21 . 2008-06-26 05:40:03 0 d-----w- C:\Documents and Settings\All Users\Application Data\Google Updater
2009-12-02 09:13:32 . 2006-08-26 00:43:42 0 d-----w- C:\Program Files\Google
2009-12-02 02:07:51 . 2009-02-24 00:31:37 411368 ----a-w- C:\WINDOWS\system32\deploytk.dll
2009-12-02 01:36:19 . 2009-09-24 19:09:29 0 d-----w- C:\Documents and Settings\All Users\Application Data\NOS
2009-12-02 00:24:06 . 2006-07-05 23:35:17 94208 ----a-w- C:\WINDOWS\DUMPb3a0.tmp
2009-12-02 00:21:49 . 2006-07-05 23:35:17 94208 ----a-w- C:\WINDOWS\DUMPaf2b.tmp
2009-12-02 00:19:33 . 2006-07-05 23:35:17 94208 ----a-w- C:\WINDOWS\DUMPb219.tmp
2009-12-02 00:10:22 . 2006-07-06 07:41:05 0 d-----w- C:\Program Files\Java
2009-12-01 20:47:09 . 2006-07-05 23:35:17 94208 ----a-w- C:\WINDOWS\DUMPaece.tmp
2009-12-01 20:46:00 . 2006-07-05 23:35:17 94208 ----a-w- C:\WINDOWS\DUMPb13f.tmp
2009-11-26 21:20:16 . 2009-10-24 07:39:13 236280 ----a-w- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-11-23 22:23:35 . 2008-04-24 18:20:25 0 d-----w- C:\Documents and Settings\Me\Application Data\FileZilla
2009-11-18 06:31:42 . 2009-11-18 06:31:42 0 ----a-w- C:\WINDOWS\system32\30.tmp
2009-11-18 06:31:42 . 2009-11-18 06:31:42 0 ----a-w- C:\WINDOWS\system32\2F.tmp
2009-11-17 09:18:52 . 2009-11-17 09:18:44 738816 --sha-w- C:\WINDOWS\system32\11F.tmp
2009-11-15 22:01:59 . 2009-09-11 05:41:20 0 d-----w- C:\Program Files\Spybot - Search & Destroy
2009-11-14 20:18:15 . 2006-07-22 21:26:07 50776 ----a-w- C:\Documents and Settings\Me\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-07 02:22:58 . 2008-06-17 02:01:31 0 d-----w- C:\Documents and Settings\Me\Application Data\gtk-2.0
2009-11-03 22:20:19 . 2009-02-18 02:40:58 664 ----a-w- C:\WINDOWS\system32\d3d9caps.dat
2009-10-29 20:11:54 . 2009-10-29 20:11:53 0 d-----w- C:\Program Files\Microsoft Silverlight
2009-10-29 07:20:34 . 2009-10-29 07:20:34 0 d-----w- C:\Documents and Settings\Me\Application Data\Mozilla-Cache
2009-10-29 07:20:16 . 2006-07-22 04:23:43 0 d-----w- C:\Program Files\PartyGaming.Net
2009-10-29 07:06:21 . 2008-04-27 08:12:18 0 d-----w- C:\Program Files\PartyGaming
2009-10-28 22:37:22 . 2009-10-28 22:37:22 343088 ----a-w- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\IDSvix86.sys
2009-10-28 22:37:22 . 2009-10-28 22:37:22 329592 ----a-w- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\IDSXpx86.sys
2009-10-28 22:37:21 . 2009-10-28 22:37:21 811896 ----a-w- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\Scxpx86.dll
2009-10-28 22:37:21 . 2009-10-28 22:37:21 488312 ----a-w- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\IDSxpx86.dll
2009-10-28 22:37:21 . 2009-10-28 22:37:21 466992 ----a-w- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\IDSviA64.sys
2009-10-22 20:12:44 . 2009-10-22 20:12:44 0 d-----w- C:\Program Files\eBay
2009-10-13 23:21:25 . 2006-07-22 22:56:44 0 d-----w- C:\Program Files\Common Files\Adobe
2009-10-11 07:00:49 . 2008-04-28 20:33:51 0 d-----w- C:\Documents and Settings\Me\Application Data\Microgaming
2009-10-08 06:45:41 . 2008-10-13 03:22:14 0 d-----w- C:\Program Files\Peter Drew
2009-09-24 19:10:08 . 2009-09-24 19:09:53 86016 ----a-w- C:\Documents and Settings\All Users\Application Data\NOS\Adobe_Downloads\arh.exe
2009-09-24 18:23:11 . 2009-01-13 03:07:51 68940 ----a-w- C:\WINDOWS\hpoins05.dat
2009-09-23 19:19:06 . 2009-09-23 19:19:06 49152 ----a-r- C:\WINDOWS\system32\inetwh32.dll
2009-09-23 19:19:06 . 2009-09-23 19:19:06 1044480 ----a-r- C:\WINDOWS\system32\roboex32.dll
2009-09-18 08:13:57 . 2009-09-18 08:13:57 8302 ----a-r- C:\Documents and Settings\Me\Application Data\Microsoft\Installer\{FAB88294-6EE7-4F83-9097-8E7819724EF8}\_784BC2CC2DBADFC11854EC.exe
2009-09-18 08:13:57 . 2009-09-18 08:13:57 8302 ----a-r- C:\Documents and Settings\Me\Application Data\Microsoft\Installer\{FAB88294-6EE7-4F83-9097-8E7819724EF8}\_5C61E917AB8C8724D932D5.exe
2009-09-18 08:13:57 . 2009-09-18 08:13:57 8302 ----a-r- C:\Documents and Settings\Me\Application Data\Microsoft\Installer\{FAB88294-6EE7-4F83-9097-8E7819724EF8}\_31A30127C2C6832B6BBA9D.exe
2009-09-18 08:13:57 . 2009-09-18 08:13:57 1406 ----a-r- C:\Documents and Settings\Me\Application Data\Microsoft\Installer\{FAB88294-6EE7-4F83-9097-8E7819724EF8}\_8EEE255E964F0BE8010286.exe
2009-09-18 08:13:57 . 2009-09-18 08:13:57 1406 ----a-r- C:\Documents and Settings\Me\Application Data\Microsoft\Installer\{FAB88294-6EE7-4F83-9097-8E7819724EF8}\_698165531D8150AEDAB23E.exe
2009-09-17 06:49:11 . 2009-09-17 06:49:10 1204224 ----a-w- C:\Documents and Settings\All Users\Application Data\MGS\cache\m\multistagepickxofybonus.3a30a9c7b165f5e8a337ca88ed08906c.dll
2009-09-17 06:46:02 . 2009-09-17 06:46:02 860160 ----a-w- C:\Documents and Settings\All Users\Application Data\MGS\cache\s\scoopthecashbonus.bba34ca69d484ca056b3150cf3511c31.dll
2009-09-17 06:45:04 . 2009-09-17 06:45:04 831488 ----a-w- C:\Documents and Settings\All Users\Application Data\MGS\cache\r\racebonus.0a92bce3bdb7feb1970ec9894848e1ee.dll
2009-09-17 06:43:23 . 2009-09-17 06:43:23 1171456 ----a-w- C:\Documents and Settings\All Users\Application Data\MGS\cache\w\wealthspa_stonebonus.884fe3f012cc21e9f4b94beccb344fe5.dll
2009-09-17 06:43:02 . 2009-09-17 06:43:02 1204224 ----a-w- C:\Documents and Settings\All Users\Application Data\MGS\cache\w\wealthspa_bathbonus.eaf1477312e7ecb9b1c7aa0a26e6ac61.dll
2009-09-17 06:42:10 . 2009-09-17 06:42:10 1142784 ----a-w- C:\Documents and Settings\All Users\Application Data\MGS\cache\w\wealthspa_bodywaxbonus.86b2e4bb4c8e68cbf84cdb6310c39218.dll
2009-09-17 06:41:03 . 2009-09-17 06:41:02 1290240 ----a-w- C:\Documents and Settings\All Users\Application Data\MGS\cache\w\wealthspa_smoothiebonus.779ec9c8439f59a40852d4a998367c4f.dll
2009-09-17 06:40:50 . 2009-09-17 06:40:50 827392 ----a-w- C:\Documents and Settings\All Users\Application Data\MGS\cache\p\playerinstantiatedchoosebonus.ceb25d7dda7b0effc207d3dec6e30288.dll
2009-09-17 06:39:07 . 2009-09-17 06:39:07 1196032 ----a-w- C:\Documents and Settings\All Users\Application Data\MGS\cache\w\wealthspa_massagebonus.0e575cb178075b87da73199c7e3bdcc1.dll
2009-09-11 14:18:39 . 2004-08-04 12:00:00 136192 ----a-w- C:\WINDOWS\system32\msv1_0.dll
2009-09-11 01:07:21 . 2009-09-11 01:07:21 1024000 ----a-w- C:\Documents and Settings\All Users\Application Data\MGS\cache\s\simplepickxofychoicebonus_summerholiday.2f3c0065ff052710ed0c13651e2571da.dll
2009-09-11 01:05:52 . 2009-09-11 01:05:51 679936 ----a-w- C:\Documents and Settings\All Users\Application Data\MGS\cache\t\transition_septgao_09.04686bb06cfe59ecb3f271eb95218422.dll
2009-09-11 01:05:51 . 2009-09-11 01:05:50 679936 ----a-w- C:\Documents and Settings\All Users\Application Data\MGS\cache\t\transition_wealthspa.5a3f4e96415d8b3050681cdd275f3d88.dll
2009-09-11 01:05:28 . 2009-09-11 01:05:28 1478656 ----a-w- C:\Documents and Settings\All Users\Application Data\MGS\cache\a\advancedslots1_septgao_09.1d5fda158c9a9d1dcbf9e88c5355d884.dll
2009-09-11 01:05:26 . 2009-09-11 01:05:26 1032192 ----a-w- C:\Documents and Settings\All Users\Application Data\MGS\cache\a\advancedslots1xxx_wealthspa.2cac89b1bff8f25a6a8d3748201af558.dll
2009-09-11 01:05:24 . 2009-09-11 01:05:24 1040384 ----a-w- C:\Documents and Settings\All Users\Application Data\MGS\cache\a\advancedslots1xxx_septgao_09.02b3e0bc2a35757d7c030659fd21c70a.dll
2009-09-11 01:05:22 . 2009-09-11 01:05:22 1224704 ----a-w- C:\Documents and Settings\All Users\Application Data\MGS\cache\a\advancedslots1xxx_summerholiday.ca5125cc93020b208c8104895ffd4a80.dll
2009-09-11 01:05:20 . 2009-09-11 01:05:20 1474560 ----a-w- C:\Documents and Settings\All Users\Application Data\MGS\cache\a\advancedslots1_wealthspa.548276e787b133afb9b912eb95b8b5c5.dll
2009-09-11 01:05:18 . 2009-09-11 01:05:18 1638400 ----a-w- C:\Documents and Settings\All Users\Application Data\MGS\cache\a\advancedslots1_summerholiday.19e3e7b6f28b2f036c0b87d00fc799b9.dll
2009-09-11 01:05:09 . 2009-09-11 01:05:09 618496 ----a-w- C:\Documents and Settings\All Users\Application Data\MGS\cache\g\gamble2_wealthspa.a58c586ab4d974ea2d4142fb4d851c2b.dll
2009-09-11 01:05:08 . 2009-09-11 01:05:07 618496 ----a-w- C:\Documents and Settings\All Users\Application Data\MGS\cache\g\gamble2_septgao_09.d8cd6b206ce4b18e0867e42785806a63.dll
2009-09-11 01:05:07 . 2009-09-11 01:05:07 606208 ----a-w- C:\Documents and Settings\All Users\Application Data\MGS\cache\g\gamble2_summerholiday.b02744e18c4cdb3dd3394f69d8987073.dll
2009-09-11 00:36:24 . 2009-09-11 00:36:24 417792 ----a-w- C:\Documents and Settings\All Users\Application Data\MGS\cache\m\menucore.e2df50a5930ba5d46a68f5564d204ba0.dll
2009-09-07 19:50:00 . 2009-09-07 19:50:00 152576 ----a-w- C:\Documents and Settings\Me\Application Data\Sun\Java\jre1.6.0_15\lzma.dll
2007-11-09 21:25:00 . 2008-07-26 18:57:34 57344 ----a-w- C:\Program Files\mozilla firefox\components\MGSHelper.dll
2009-04-15 20:24:54 . 2009-04-15 20:24:54 1044480 ----a-w- C:\Program Files\mozilla firefox\plugins\libdivx.dll
2009-04-15 20:24:54 . 2009-04-15 20:24:54 200704 ----a-w- C:\Program Files\mozilla firefox\plugins\ssldivx.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-11-20_05.37.18 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-12-03 06:26:30 . 2009-12-03 06:26:30 16384 C:\WINDOWS\Temp\Perflib_Perfdata_6d0.dat
+ 2009-12-03 06:25:33 . 2009-12-03 06:25:33 16384 C:\WINDOWS\Temp\Perflib_Perfdata_380.dat
- 2007-01-29 08:58:06 . 2009-07-14 11:03:14 46080 C:\WINDOWS\system32\tzchange.exe
+ 2007-01-29 08:58:06 . 2009-10-28 15:07:15 46080 C:\WINDOWS\system32\tzchange.exe
+ 2009-12-02 01:20:38 . 2009-12-02 01:20:38 85173 C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
+ 2009-11-25 09:02:59 . 2009-11-25 09:02:59 32768 C:\WINDOWS\Installer\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}\icon.exe
+ 2009-12-02 09:16:40 . 2009-12-02 09:16:40 25214 C:\WINDOWS\Installer\{9074AFC0-CFDA-11DE-B484-005056806466}\UNINST_Uninstall_G_F6A848FB884248E6A4CDCBDCF41F6A74_1.exe
+ 2009-12-02 09:16:40 . 2009-12-02 09:16:40 25214 C:\WINDOWS\Installer\{9074AFC0-CFDA-11DE-B484-005056806466}\UNINST_Uninstall_G_F6A848FB884248E6A4CDCBDCF41F6A74.exe
+ 2009-12-02 09:16:40 . 2009-12-02 09:16:40 25214 C:\WINDOWS\Installer\{9074AFC0-CFDA-11DE-B484-005056806466}\ShortcutOGL_EB071909B9884F8CBF3D6115D4ADEE5E.exe
+ 2009-12-02 09:16:40 . 2009-12-02 09:16:40 25214 C:\WINDOWS\Installer\{9074AFC0-CFDA-11DE-B484-005056806466}\ShortcutDX_EB071909B9884F8CBF3D6115D4ADEE5E.exe
+ 2009-12-02 09:16:40 . 2009-12-02 09:16:40 25214 C:\WINDOWS\Installer\{9074AFC0-CFDA-11DE-B484-005056806466}\googleearth.exe1_F6A848FB884248E6A4CDCBDCF41F6A74.exe
+ 2009-12-02 09:16:40 . 2009-12-02 09:16:40 25214 C:\WINDOWS\Installer\{9074AFC0-CFDA-11DE-B484-005056806466}\googleearth.exe_F6A848FB884248E6A4CDCBDCF41F6A74.exe
+ 2009-12-02 09:16:39 . 2009-12-02 09:16:39 25214 C:\WINDOWS\Installer\{9074AFC0-CFDA-11DE-B484-005056806466}\ARPPRODUCTICON.exe
- 2009-09-07 19:54:26 . 2009-07-25 10:23:07 149280 C:\WINDOWS\system32\javaws.exe
+ 2009-12-02 02:08:50 . 2009-12-02 02:07:53 149280 C:\WINDOWS\system32\javaws.exe
+ 2009-12-02 02:08:50 . 2009-12-02 02:07:53 145184 C:\WINDOWS\system32\javaw.exe
- 2009-09-07 19:54:26 . 2009-07-25 10:23:07 145184 C:\WINDOWS\system32\javaw.exe
+ 2009-12-02 02:08:50 . 2009-12-02 02:07:53 145184 C:\WINDOWS\system32\java.exe
- 2009-09-07 19:54:26 . 2009-07-25 10:23:05 145184 C:\WINDOWS\system32\java.exe
+ 2009-11-25 09:02:56 . 2009-11-25 09:02:56 429568 C:\WINDOWS\Installer\53af131.msi
+ 2009-12-02 02:07:48 . 2009-12-02 02:07:48 537600 C:\WINDOWS\Installer\1e0fff.msi
+ 2009-11-20 21:17:39 . 2009-11-20 21:17:39 794112 C:\WINDOWS\Installer\18af0.msi
+ 2009-11-20 18:08:32 . 2009-11-20 18:08:32 371272 C:\WINDOWS\Installer\{D103C4BA-F905-437A-8049-DB24763BBE36}\SkypeIcon.exe
+ 2009-07-21 06:03:48 . 2009-07-21 06:03:48 1348432 C:\WINDOWS\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9876.0_x-ww_a621d1d5\msxml4.dll
+ 2008-08-30 01:30:27 . 2009-07-31 16:05:44 1372672 C:\WINDOWS\system32\msxml6.dll
+ 2009-07-21 06:05:40 . 2009-07-21 06:05:40 1348432 C:\WINDOWS\system32\msxml4.dll
+ 2004-08-04 12:00:00 . 2009-07-31 04:35:42 1172480 C:\WINDOWS\system32\msxml3.dll
+ 2008-08-30 01:30:27 . 2009-07-31 16:05:44 1372672 C:\WINDOWS\system32\dllcache\msxml6.dll
+ 2008-11-12 13:18:57 . 2009-07-31 04:35:42 1172480 C:\WINDOWS\system32\dllcache\msxml3.dll
+ 2009-11-20 18:08:31 . 2009-11-20 18:08:31 1565696 C:\WINDOWS\Installer\2b10404.msi
+ 2009-12-02 09:16:36 . 2009-12-02 09:16:37 1258496 C:\WINDOWS\Installer\19aac48.msi
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-06-26 05:40:05 68856]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2009-10-09 19:11:12 25623336]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 12:00:00 208952]
"Apoint"="C:\Program Files\Apoint2K\Apoint.exe" [2005-02-08 21:38:10 159744]
"Cpqset"="C:\Program Files\HPQ\Default Settings\cpqset.exe" [2004-09-07 23:28:26 213054]
"UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 08:01:00 110592]
"hpWirelessAssistant"="C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2004-12-08 16:36:42 790528]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifSvc.exe" [2008-01-29 22:38:31 583048]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2008-06-10 17:56:32 1406024]
"WatchDog"="C:\Program Files\InterVideo\DVD Check\DVDCheck.exe" [2004-12-09 01:44:36 184320]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2009-05-26 22:18:30 413696]
"SunJavaUpdateSched"="C:\Program Files\Java\jre6\bin\jusched.exe" [2009-12-02 02:07:58 149280]
"AGRSMMSG"="AGRSMMSG.exe" - C:\WINDOWS\AGRSMMSG.exe [2005-04-13 14:12:38 88209]

C:\Documents and Settings\Me\Start Menu\Programs\Startup\
SDK Tray Menu.lnk - C:\Sun\SDK\jdk\bin\javaw.exe [2009-12-1 139264]

C:\Documents and Settings\Me\Start Menu\Programs\Startup\AutorunsDisabled
hpqtra08.exe [2004-5-28 241664]
hpzinw12.exe [2004-9-29 61440]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
DVD Check.lnk - C:\Program Files\InterVideo\DVD Check\DVDCheck.exe [2006-7-6 184320]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 03:41:34 304128]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]
@="FSFilter Activity Monitor"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk.disabled]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk.disabled
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnk.disabledCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk.disabled]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk.disabled
backup=C:\WINDOWS\pss\HP Image Zone Fast Start.lnk.disabledCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Windows Search.lnk.disabled]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk.disabled
backup=C:\WINDOWS\pss\Windows Search.lnk.disabledCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Me^Start Menu^Programs^Startup^hpqtra08.exe]
path=C:\Documents and Settings\Me\Start Menu\Programs\Startup\hpqtra08.exe
backup=C:\WINDOWS\pss\hpqtra08.exeStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Me^Start Menu^Programs^Startup^HPZinw12.exe]
path=C:\Documents and Settings\Me\Start Menu\Programs\Startup\HPZinw12.exe
backup=C:\WINDOWS\pss\HPZinw12.exeStartup

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
"YSearchProtection"=C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
"Search Protection"=C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SunJavaUpdateSched"="C:\Program Files\Java\jre6\bin\jusched.exe"
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" -atboottime
"PHIME2002ASync"=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
"PHIME2002A"=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
"KernelFaultCheck"=%systemroot%\system32\dumprep 0 -k
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe"
"WatchDog"=C:\Program Files\InterVideo\DVD Check\DVDCheck.exe
"SoundMAX"=C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray
"SoundMAXPnP"=C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
"YSearchProtection"="C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
"IgfxTray"=C:\WINDOWS\system32\igfxtray.exe
"Adobe ARM"="C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe
"eabconfg.cpl"=C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"MSConfig"=C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\WINDOWS\\system32\\spoolsv.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\TEMP\\HP_WebRelease\\Setup\\HPZnet01.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"C:\\WINDOWS\\system32\\java.exe"=
"C:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"C:\\Sun\\SDK\\jdk\\bin\\java.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 SymEFA;Symantec Extended File Attributes;C:\WINDOWS\system32\drivers\NAV\1007020.00B\SymEFA.sys [8/31/2009 5:16:07 PM 310320]
R1 BHDrvx86;Symantec Heuristics Driver;C:\WINDOWS\system32\drivers\NAV\1007020.00B\BHDrvx86.sys [8/31/2009 5:16:07 PM 259632]
R1 ccHP;Symantec Hash Provider;C:\WINDOWS\system32\drivers\NAV\1007020.00B\cchpx86.sys [8/31/2009 5:04:26 PM 482432]
R1 IDSxpx86;IDSxpx86;C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091111.001\IDSXpx86.sys [11/12/2009 3:05:17 PM 329592]
R2 Norton AntiVirus;Norton AntiVirus;C:\Program Files\Norton AntiVirus\Norton AntiVirus\Engine\16.7.2.11\ccSvcHst.exe [8/31/2009 5:15:41 PM 117640]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [12/1/2009 10:05:54 AM 102448]
S2 gupdate1c9d517aa5a5782;Google Update Service (gupdate1c9d517aa5a5782);C:\Program Files\Google\Update\GoogleUpdate.exe [5/14/2009 10:43:12 PM 133104]
.
Contents of the 'Scheduled Tasks' folder

2009-12-04 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34:12 . 2008-07-30 17:34:12]

2009-12-04 C:\WINDOWS\Tasks\Google Software Updater.job
- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-01-24 14:44:38 . 2009-03-24 17:15:15]

2009-11-01 C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
- C:\Program Files\Google\Update\GoogleUpdate.exe [2009-05-15 04:43:12 . 2009-05-15 04:43:05]

2009-12-04 C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
- C:\Program Files\Google\Update\GoogleUpdate.exe [2009-05-15 04:43:12 . 2009-05-15 04:43:05]

2009-12-03 C:\WINDOWS\Tasks\SDMsgUpdate (TE).job
- C:\PROGRA~1\SMARTD~1\Messages\SDNotify.exe [2009-01-30 20:27:34 . 2008-08-11 12:29:50]
.

[Blade81]

Please run GMER scan and post back the results.

[ericl]

GMER 1.0.15.15252 - http://www.gmer.net
Rootkit scan 2009-12-04 11:32:43
Windows 5.1.2600 Service Pack 3
Running: 5t2cvnmg.exe; Driver: C:\DOCUME~1\Me\LOCALS~1\Temp\kxldypow.sys


---- System - GMER 1.0.15 ----

SSDT 89D0AD88 ZwAlertResumeThread
SSDT 89D0EC88 ZwAlertThread
SSDT 89C68E78 ZwAllocateVirtualMemory
SSDT 89CFCB18 ZwAssignProcessToJobObject
SSDT 8A059450 ZwConnectPort
SSDT \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwCreateKey [0xAAD7C130]
SSDT 89D4EAF0 ZwCreateMutant
SSDT 89496B28 ZwCreateSymbolicLinkObject
SSDT 89D44AF8 ZwCreateThread
SSDT 89D43A10 ZwDebugActiveProcess
SSDT \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwDeleteKey [0xAAD7C3B0]
SSDT \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwDeleteValueKey [0xAAD7C910]
SSDT 89C6D3E0 ZwDuplicateObject
SSDT 89D0DEB0 ZwFreeVirtualMemory
SSDT 89D4EBC0 ZwImpersonateAnonymousToken
SSDT 89D0ACC8 ZwImpersonateThread
SSDT 89ECE818 ZwLoadDriver
SSDT 89CCB310 ZwMapViewOfSection
SSDT 89D4EA10 ZwOpenEvent
SSDT 894669A8 ZwOpenProcess
SSDT 89C68F48 ZwOpenProcessToken
SSDT 89D54A38 ZwOpenSection
SSDT 89C6D470 ZwOpenThread
SSDT 89CFCA28 ZwProtectVirtualMemory
SSDT 89C53870 ZwResumeThread
SSDT 8A073D40 ZwSetContextThread
SSDT 89D52A28 ZwSetInformationProcess
SSDT 89D43AF0 ZwSetSystemInformation
SSDT \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwSetValueKey [0xAAD7CB60]
SSDT 89D54B18 ZwSuspendProcess
SSDT 89D0ED68 ZwSuspendThread
SSDT 89D509B8 ZwTerminateProcess
SSDT 8A073C60 ZwTerminateThread
SSDT 89D52B18 ZwUnmapViewOfSection
SSDT 89D0DF80 ZwWriteVirtualMemory

Code \??\C:\DOCUME~1\Me\LOCALS~1\Temp\catchme.sys pIofCallDriver

---- Kernel code sections - GMER 1.0.15 ----

.text ntkrnlpa.exe!ZwCallbackReturn + 2410 80501C48 4 Bytes JMP E33689D4
.text ntkrnlpa.exe!ZwCallbackReturn + 24E8 80501D20 4 Bytes CALL 457EA711
.text ntkrnlpa.exe!ZwCallbackReturn + 252C 80501D64 4 Bytes JMP D54A89D4
.text ntkrnlpa.exe!ZwCallbackReturn + 2769 80501FA1 7 Bytes [09, D5, 89, 60, 3C, 07, 8A]
? SYMEFA.SYS The system cannot find the file specified. !
init C:\WINDOWS\system32\drivers\tifm21.sys entry point in "init" section [0xF683483F]
init C:\WINDOWS\system32\drivers\senfilt.sys entry point in "init" section [0xF672FF80]
? C:\DOCUME~1\Me\LOCALS~1\Temp\catchme.sys The system cannot find the file specified. !
? C:\WINDOWS\system32\Drivers\PROCEXP113.SYS The system cannot find the file specified. !

---- User code sections - GMER 1.0.15 ----

.text C:\Program Files\Mozilla Firefox\firefox.exe[1676] ntdll.dll!RtlValidateUnicodeString + 554 7C9163BE 10 Bytes JMP 0376003A
.text C:\WINDOWS\system32\SearchIndexer.exe[1712] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 00585C0C C:\WINDOWS\system32\MSSRCH.DLL (mssrch.dll/Microsoft Corporation)

---- Devices - GMER 1.0.15 ----

Device Ntfs.sys (NT File System Driver/Microsoft Corporation)
Device Udfs.SYS (UDF File System Driver/Microsoft Corporation)

AttachedDevice \Driver\Tcpip \Device\Ip SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 EABFiltr.sys (QLB PS/2 Keyboard filter driver/Hewlett-Packard Company)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 EABFiltr.sys (QLB PS/2 Keyboard filter driver/Hewlett-Packard Company)
AttachedDevice \Driver\Tcpip \Device\Tcp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Udp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\RawIp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)

---- Registry - GMER 1.0.15 ----

Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@DeviceNotSelectedTimeout 15
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@GDIProcessHandleQuota 10000
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@Spooler yes
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@swapdisk
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@TransmissionRetryTimeout 90
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@USERProcessHandleQuota 10000

---- EOF - GMER 1.0.15 ----

[Blade81]

Does redirecting still occur with both Firefox and IE?

[ericl]

Redirection is taking place in only Firefox.

However, I checked it before I restarted my computer and there was no redirect. Only after I restarted did the redirect stuff start again in firefox.

[Blade81]

Hi,

Please download GooredFix from one of the locations below and save it to your Desktop
Download Mirror #1 (http://jpshortstuff.247fixes.com/GooredFix.exe)
Download Mirror #2 (http://downloads.securitycadets.com/GooredFix.exe) Ensure all Firefox windows are closed. To run the tool, double-click it (XP), or right-click and select Run As Administrator (Vista). When prompted to run the scan, click Yes. GooredFix will check for infections, and then a log will appear. Please post the contents of that log in your next reply (it can also be found on your desktop, called GooredFix.txt).

[ericl]

GooredFix by jpshortstuff (27.11.09.1)
Log created at 12:24 on 04/12/2009 (Me)
Firefox version 3.5.5 (en-US)

========== GooredScan ==========


========== GooredLog ==========

C:\Program Files\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd} [10:11 30/06/2007]
{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} [00:31 24/02/2009]
{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} [00:28 21/04/2009]
{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} [08:15 10/06/2009]
{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} [02:09 02/12/2009]

[HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]
"{000a9d1c-beef-4f90-9363-039d445309b8}"="C:\Program Files\Google\Google Gears\Firefox\" [03:59 04/11/2009]
"jqs@sun.com"="C:\Program Files\Java\jre6\lib\deploy\jqs\ff" [02:08 02/12/2009]

-=E.O.F=-

[Blade81]

Hi,

My recommendation is to reinstall Firefox completely and see if redirecting still exists. That means profile and customization too ("Remove my Firefox personal data and customizations" -option checked).

[ericl]

I think that got it. Thanks so much!

[Blade81]

You're welcome :)

Here're some final steps to follow.


THESE STEPS ARE VERY IMPORTANT

Let's reset system restore
Reset and Re-enable your System Restore to remove infected files that have been backed up by Windows. The files in System Restore are protected to prevent any programs changing those files. This is the only way to clean these files: You will lose all previous restore points which are likely to be infected. Please note you need Administrator Access to do clean the restore points.

1. Turn off System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

2. Reboot.

3. Turn ON System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK.
NOTE: only do this ONCE,NOT on a regular basis



Now lets uninstall ComboFix:

Click START then RUN
Now copy-paste Combofix /uninstall in the runbox and click OK



Please download OTC (http://oldtimer.geekstogo.com/OTC.exe) and save it to desktop.

Double-click OTC.exe.
Click the CleanUp! button.
Select Yes when the
Begin cleanup Process?
prompt appears.
If you are prompted to Reboot during the cleanup, select Yes.
The tool will delete itself once it finishes, if not delete it by yourself.


Note: If you receive a warning from your firewall or other security programs regarding OTC attempting to contact the internet, please allow it to do so.


UPDATING WINDOWS AND INTERNET EXPLORER

IMPORTANT: You Need to Update Windows and Internet Explorer to protect your computer from the malware that is around on the Internet. Please go to the windows update site (http://windowsupdate.microsoft.com/) to get the critical updates.

If you are running Microsoft Office, or any portion thereof, go to the Microsoft's Office Update site and make sure you have at least all the critical updates installed (Free) Microsoft Office Update.


Make your Internet Explorer more secure

This can be done by following these simple instructions:
From within Internet Explorer click on the Tools menu and then click on Options.
Click once on the Security tab
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
Change the Download signed ActiveX controls to Prompt
Change the Download unsigned ActiveX controls to Disable
Change the Initialize and script ActiveX controls not marked as safe to Disable
Change the Installation of desktop items to Prompt
Change the Launching programs and files in an IFRAME to Prompt
Change the Navigate sub-frames across different domains to Prompt
When all these settings have been made, click on the OK button.
If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.



The following are recommended third party programs that are designed to keep your computer clean. A link as well as a brief description is included with each item.


hosts file:
Every version of windows has a hosts file as part of them. In a very basic sense, they are used to locate webpages. We can customize a hosts file so that it blocks certain webpages. However, it can slow down certain computers. This is why using a hosts file is optional!!
Download it here (http://www.mvps.org/winhelp2002/hosts.htm). Make sure you read the instructions on how to install the hosts file. There is a good tutorial here (http://www.bleepingcomputer.com/forums/tutorial51.html)
If you decide to download the hosts file, the slowdown problems can usually be avoided by following these steps:
Click the start button (at the lower left hand corner of your screen) Click run In the dialog box, type services.msc hit enter, then locate dns client Highlight it, then double-click it. On the dropdown box, change the setting from automatic to manual. Click ok



Just a final reminder for you. I am trying to stress these two points.
UPDATE UPDATE UPDATE!!! Make sure you do this about every 1-2 weeks.
Make sure all of your security programs are up to date.
Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.



Once again, please post and tell me how things are going with your system... problems etc.

Have a great day,
Blade :cool:

[Blade81]

Since this issue appears to be resolved ... this Topic has been closed. Glad I could help. :)

Note:If it has been four days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh HijackThis log and a link to your previous thread.

If it has been less than four days since your last response and you need the thread re-opened, please send me or MOD a private message (pm). A valid, working link to the closed topic is required.