ComboFix 09-12-26.05 - Duane Pankhurst 12/27/2009 14:06:58.1.2 - x86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2013.1273 [GMT -6:00] Running from: c:\documents and settings\[removed]\Desktop\whatthetech\ComboFix.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\Caledonia Pankhurst\Application Data\020000000dc00c7d720C.manifest c:\documents and settings\Caledonia Pankhurst\Application Data\020000000dc00c7d720O.manifest c:\documents and settings\Caledonia Pankhurst\Application Data\020000000dc00c7d720P.manifest c:\documents and settings\Caledonia Pankhurst\Application Data\020000000dc00c7d720S.manifest c:\documents and settings\Duane Pankhurst\Application Data\020000000dc00c7d720C.manifest c:\documents and settings\Duane Pankhurst\Application Data\020000000dc00c7d720O.manifest c:\documents and settings\Duane Pankhurst\Application Data\020000000dc00c7d720P.manifest c:\documents and settings\Duane Pankhurst\Application Data\020000000dc00c7d720S.manifest c:\documents and settings\Duane Pankhurst\Desktop\Internet Security 2010.lnk c:\documents and settings\Duane Pankhurst\Start Menu\Internet Security 2010.lnk c:\documents and settings\Shannon O'Conner\Application Data\020000000dc00c7d720C.manifest c:\documents and settings\Shannon O'Conner\Application Data\020000000dc00c7d720O.manifest c:\documents and settings\Shannon O'Conner\Application Data\020000000dc00c7d720P.manifest c:\documents and settings\Shannon O'Conner\Application Data\020000000dc00c7d720S.manifest c:\windows\system32\1048809671 c:\windows\system32\18467.exe c:\windows\system32\unrar.exe . ((((((((((((((((((((((((( Files Created from 2009-11-27 to 2009-12-27 ))))))))))))))))))))))))))))))) . 2009-12-27 18:54 . 2009-11-27 09:00 84912 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091227.004\NAVENG.SYS 2009-12-27 18:54 . 2009-11-27 09:00 177520 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091227.004\NAVENG32.DLL 2009-12-27 18:54 . 2009-11-27 09:00 1647984 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091227.004\NAVEX32A.DLL 2009-12-27 18:54 . 2009-11-27 09:00 1323568 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091227.004\NAVEX15.SYS 2009-12-27 18:54 . 2009-12-09 09:00 2747440 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091227.004\CCERASER.DLL 2009-12-27 18:54 . 2009-11-27 09:00 371248 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091227.004\EECTRL.SYS 2009-12-27 18:54 . 2009-11-27 09:00 259440 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091227.004\ECMSVR32.DLL 2009-12-27 18:54 . 2009-11-27 09:00 102448 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091227.004\ERASER.SYS 2009-12-27 17:33 . 2009-12-27 17:33 -------- d-----w- c:\documents and settings\Duane Pankhurst\Application Data\Malwarebytes 2009-12-27 17:33 . 2009-12-03 22:14 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-12-27 17:33 . 2009-12-27 17:33 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2009-12-27 17:33 . 2009-12-27 17:33 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-12-27 17:33 . 2009-12-03 22:13 19160 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-12-27 17:31 . 2009-12-27 17:31 -------- d-----w- c:\program files\ERUNT 2009-12-24 02:37 . 2009-12-24 02:37 -------- d-----w- c:\windows\Sun 2009-12-24 01:36 . 2009-12-24 01:44 -------- d-----w- c:\documents and settings\Duane Pankhurst\Application Data\LimeWire 2009-12-22 15:38 . 2009-12-24 02:02 -------- d-----w- c:\documents and settings\Caledonia Pankhurst\Application Data\BitTorrent 2009-12-18 20:41 . 2009-11-05 07:30 811896 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091217.002\Scxpx86.dll 2009-12-18 20:41 . 2009-11-05 07:30 488312 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091217.002\IDSxpx86.dll 2009-12-18 20:41 . 2009-11-05 07:30 466992 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091217.002\IDSviA64.sys 2009-12-18 20:41 . 2009-11-05 07:30 343088 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091217.002\IDSvix86.sys 2009-12-18 20:41 . 2009-11-05 07:30 329592 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091217.002\IDSXpx86.sys 2009-12-18 01:30 . 2009-12-18 01:30 -------- d-----w- c:\documents and settings\Duane Pankhurst\Application Data\Final Draft 2009-12-18 01:25 . 2005-07-05 17:47 1073152 ----a-r- c:\windows\system32\cdintf210.dll 2009-12-18 01:25 . 2009-12-18 01:25 -------- d-----w- c:\documents and settings\All Users\Application Data\Final Draft 2009-12-18 01:25 . 2009-12-18 01:25 51712 ----a-r- c:\documents and settings\Duane Pankhurst\Application Data\Microsoft\Installer\{78D62D17-D970-42DA-B8CF-5E5576293B33}\Icon78D62D174.exe 2009-12-18 01:25 . 2009-12-18 01:25 51712 ----a-r- c:\documents and settings\Duane Pankhurst\Application Data\Microsoft\Installer\{78D62D17-D970-42DA-B8CF-5E5576293B33}\Icon78D62D173.exe 2009-12-18 01:25 . 2009-12-18 01:25 51712 ----a-r- c:\documents and settings\Duane Pankhurst\Application Data\Microsoft\Installer\{78D62D17-D970-42DA-B8CF-5E5576293B33}\Icon78D62D172.exe 2009-12-18 01:25 . 2009-12-18 01:25 27648 ----a-r- c:\documents and settings\Duane Pankhurst\Application Data\Microsoft\Installer\{78D62D17-D970-42DA-B8CF-5E5576293B33}\Icon78D62D171.exe 2009-12-18 01:24 . 2009-12-18 01:26 -------- d-----w- c:\program files\Final Draft 7 2009-12-18 01:24 . 2009-12-18 01:24 -------- d-----w- c:\program files\Final Draft Tagger 2009-12-18 01:24 . 2009-12-18 01:24 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard 2009-12-17 19:25 . 2009-11-05 07:30 811896 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091216.001\Scxpx86.dll 2009-12-17 19:25 . 2009-11-05 07:30 488312 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091216.001\IDSxpx86.dll 2009-12-17 19:25 . 2009-11-05 07:30 466992 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091216.001\IDSviA64.sys 2009-12-17 19:25 . 2009-11-05 07:30 343088 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091216.001\IDSvix86.sys 2009-12-17 19:25 . 2009-11-05 07:30 329592 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091216.001\IDSXpx86.sys 2009-12-11 14:18 . 2009-12-11 14:21 -------- d-----w- c:\documents and settings\Caledonia Pankhurst\Local Settings\Application Data\Canon Easy-PhotoPrint EX 2009-12-09 13:37 . 2009-12-09 13:37 -------- d-----w- c:\documents and settings\Caledonia Pankhurst\Application Data\Canon 2009-12-08 01:48 . 2009-12-08 01:48 -------- d-----w- c:\documents and settings\Caledonia Pankhurst\Application Data\Intuit 2009-12-06 21:02 . 2009-12-19 16:13 -------- d-----w- c:\documents and settings\Shannon O'Conner\Local Settings\Application Data\Canon Easy-PhotoPrint EX 2009-12-02 00:56 . 2009-12-02 01:29 -------- d-----w- C:\UBCD4Win 2009-12-02 00:37 . 2009-12-02 00:41 -------- d-----w- C:\xpcd 2009-12-01 23:49 . 2009-12-01 23:55 -------- d-----w- C:\vista cd 2009-11-29 14:10 . 2009-11-29 14:10 -------- d-----w- C:\Intel 2009-11-29 13:59 . 2009-11-29 14:08 -------- d-----w- c:\documents and settings\Duane Pankhurst\Local Settings\Application Data\Deployment 2009-11-28 14:29 . 2009-08-25 23:34 36400 ----a-r- c:\windows\system32\drivers\SymIM.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-12-27 17:10 . 2009-10-26 21:22 -------- d-----w- c:\documents and settings\All Users\Application Data\CanonIJPLM 2009-12-26 13:55 . 2009-10-29 23:23 664 ----a-w- c:\windows\system32\d3d9caps.dat 2009-12-25 00:33 . 2009-10-29 23:51 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help 2009-12-24 15:28 . 2009-11-23 00:23 -------- d-----w- c:\documents and settings\Duane Pankhurst\Application Data\BitTorrent 2009-12-24 10:02 . 2009-10-30 13:57 -------- d-----w- c:\documents and settings\Duane Pankhurst\Application Data\Online Backup 2009-12-19 15:22 . 2009-11-19 17:41 -------- d-----w- c:\documents and settings\Shannon O'Conner\Application Data\Canon 2009-12-19 02:08 . 2009-11-23 01:27 71072 ----a-w- c:\documents and settings\Caledonia Pankhurst\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-12-18 14:50 . 2009-11-16 14:09 71072 ----a-w- c:\documents and settings\Shannon O'Conner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-12-18 11:59 . 2009-10-09 21:12 71072 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-12-13 19:53 . 2009-10-31 00:51 -------- d-----w- c:\program files\eMachineShop 2009-11-27 22:02 . 2009-11-27 16:42 806 ----a-w- c:\windows\system32\drivers\SYMEVENT.INF 2009-11-27 22:02 . 2009-11-27 16:42 7456 ----a-w- c:\windows\system32\drivers\SYMEVENT.CAT 2009-11-27 22:02 . 2009-11-27 16:42 60808 ----a-w- c:\windows\system32\S32EVNT1.DLL 2009-11-27 22:02 . 2009-11-27 16:42 124976 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS 2009-11-27 22:02 . 2009-11-27 16:42 -------- d-----w- c:\program files\Symantec 2009-11-27 16:54 . 2009-11-27 04:10 -------- d-----w- c:\program files\Common Files\Symantec Shared 2009-11-27 16:42 . 2009-11-27 16:42 1294680 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\SyKnAppS\SyKnAppS.dll 2009-11-27 16:42 . 2009-11-27 16:42 136840 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\SyKnAppS\patch25.dll 2009-11-27 16:42 . 2009-11-27 16:42 791920 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\CLT\cltLMSx.dll 2009-11-27 16:41 . 2009-11-27 04:13 -------- d-----w- c:\program files\Norton AntiVirus 2009-11-27 16:41 . 2009-11-27 14:20 -------- d-----w- c:\documents and settings\All Users\Application Data\Norton 2009-11-27 16:41 . 2009-11-27 16:41 -------- d-----w- c:\program files\NortonInstaller 2009-11-27 15:04 . 2009-11-27 04:10 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec 2009-11-27 14:20 . 2009-11-27 14:20 -------- d-----w- c:\program files\Windows Sidebar 2009-11-27 14:20 . 2009-11-27 14:20 -------- d-----w- c:\documents and settings\All Users\Application Data\PCSettings 2009-11-27 05:02 . 2009-10-09 21:08 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee 2009-11-27 03:46 . 2009-11-27 03:46 -------- d-----w- c:\documents and settings\All Users\Application Data\NortonInstaller 2009-11-25 15:09 . 2009-10-09 21:08 -------- d-----w- c:\program files\Common Files\Adobe 2009-11-25 14:54 . 2009-11-25 14:54 -------- d-----w- c:\documents and settings\Caledonia Pankhurst\Application Data\CyberLink 2009-11-24 14:17 . 2009-11-24 14:17 -------- d-----w- c:\documents and settings\Caledonia Pankhurst\Application Data\Sesame Street 2009-11-23 14:24 . 2009-11-23 14:24 -------- d-----w- c:\documents and settings\Caledonia Pankhurst\Application Data\Windows Search 2009-11-23 01:28 . 2009-11-23 01:28 -------- d-----w- c:\documents and settings\Caledonia Pankhurst\Application Data\Dell 2009-11-23 00:47 . 2009-11-23 00:40 -------- d-----w- c:\documents and settings\Duane Pankhurst\Application Data\ImgBurn 2009-11-23 00:36 . 2009-11-23 00:36 -------- d-----w- c:\program files\ImgBurn 2009-11-23 00:23 . 2009-11-23 00:23 -------- d-----w- c:\program files\BitTorrent 2009-11-18 22:47 . 2009-11-18 22:46 -------- d-----w- c:\documents and settings\Shannon O'Conner\Application Data\Move Networks 2009-11-18 22:46 . 2009-11-18 22:46 127325 ----a-w- c:\documents and settings\Shannon O'Conner\Application Data\Move Networks\uninstall.exe 2009-11-18 22:46 . 2009-08-13 19:21 4187512 ----a-w- c:\documents and settings\Shannon O'Conner\Application Data\Move Networks\plugins\npqmp071505000011.dll 2009-11-17 02:16 . 2009-11-17 02:16 -------- d-----w- c:\program files\CONEXANT 2009-11-16 17:33 . 2009-11-16 17:33 -------- d-----w- c:\documents and settings\All Users\Application Data\CyberLink 2009-11-16 15:06 . 2009-11-16 15:06 -------- d-----w- c:\documents and settings\Shannon O'Conner\Application Data\CyberLink 2009-11-16 14:43 . 2009-11-16 14:43 -------- d-----w- c:\documents and settings\Shannon O'Conner\Application Data\Windows Search 2009-11-16 14:10 . 2009-11-16 14:10 -------- d-----w- c:\documents and settings\Shannon O'Conner\Application Data\Dell 2009-11-05 07:30 . 2009-11-27 17:43 811896 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091111.001\Scxpx86.dll 2009-11-05 07:30 . 2009-11-27 17:43 488312 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091111.001\IDSxpx86.dll 2009-11-05 07:30 . 2009-11-27 17:43 466992 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091111.001\IDSviA64.sys 2009-11-05 07:30 . 2009-11-27 17:43 343088 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091111.001\IDSvix86.sys 2009-11-05 07:30 . 2009-11-27 17:43 329592 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091111.001\IDSXpx86.sys 2009-11-05 07:30 . 2009-11-27 16:42 466992 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\IDSviA64.sys 2009-11-05 07:30 . 2009-11-27 16:42 343088 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\IDSvix86.sys 2009-11-05 07:30 . 2009-11-27 16:42 329592 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\IDSXpx86.sys 2009-11-05 07:30 . 2009-11-27 16:42 811896 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\Scxpx86.dll 2009-11-05 07:30 . 2009-11-27 16:42 488312 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\IDSxpx86.dll 2009-10-31 08:01 . 2009-10-30 00:00 -------- d-----w- c:\program files\Microsoft SQL Server 2009-10-31 00:52 . 2009-10-31 00:51 -------- d-----w- c:\documents and settings\Duane Pankhurst\Application Data\PGP 2009-10-30 13:56 . 2009-10-27 23:57 -------- d-----w- c:\program files\Quicken 2009-10-30 08:05 . 2009-10-30 08:05 -------- d-----w- c:\program files\MSXML 6.0 2009-10-30 00:02 . 2009-10-30 00:02 -------- d-----w- c:\program files\Microsoft Small Business 2009-10-30 00:01 . 2009-10-29 23:53 -------- d-----w- c:\program files\Microsoft.NET 2009-10-29 23:54 . 2009-10-29 23:38 -------- d-----w- c:\documents and settings\Duane Pankhurst\Application Data\GetRightToGo 2009-10-29 23:18 . 2009-10-09 21:15 -------- d-----w- c:\program files\Microsoft Silverlight 2009-10-29 13:13 . 2009-10-29 13:12 -------- d-----w- c:\documents and settings\Duane Pankhurst\Application Data\Canon 2009-10-29 12:44 . 2009-10-09 21:11 -------- d-----w- c:\program files\Microsoft Works 2009-10-29 12:43 . 2009-10-29 12:43 -------- d-----w- c:\program files\Microsoft CAPICOM 2.1.0.2 2009-10-29 07:45 . 2008-04-25 16:16 916480 ----a-w- c:\windows\system32\wininet.dll 2009-10-29 02:48 . 2009-10-09 21:12 -------- d--h--w- c:\program files\InstallShield Installation Information 2009-10-29 02:48 . 2009-10-26 20:39 -------- d-----w- c:\program files\Canon 2009-10-28 02:21 . 2009-10-28 01:49 614 ----a-w- c:\documents and settings\Duane Pankhurst\Application Data\wklnhst.dat 2009-10-28 00:01 . 2009-10-28 00:01 5898240 ----a-w- c:\documents and settings\All Users\Application Data\Intuit\Quicken\Inet\Common\patch\Update\171411-17153.dll 2009-10-28 00:00 . 2009-10-28 00:00 2723840 ----a-w- c:\documents and settings\All Users\Application Data\Intuit\Quicken\Inet\Common\patch\Update\17153-17167.dll 2009-10-28 00:00 . 2009-10-28 00:00 3497984 ----a-w- c:\documents and settings\All Users\Application Data\Intuit\Quicken\Inet\Common\patch\Update\17122-17137.dll 2009-10-28 00:00 . 2009-10-28 00:00 3379200 ----a-w- c:\documents and settings\All Users\Application Data\Intuit\Quicken\Inet\Common\patch\Update\17137-171411.dll 2009-10-28 00:00 . 2009-10-28 00:00 581632 ----a-w- c:\documents and settings\All Users\Application Data\Intuit\Quicken\Inet\Common\patch\Update\17167-17175.dll 2009-10-27 23:59 . 2009-10-27 23:59 634880 ----a-w- c:\documents and settings\All Users\Application Data\Intuit\Quicken\Inet\Common\patch\Update\17182-17192.dll 2009-10-27 23:59 . 2009-10-27 23:59 242976 ----a-w- c:\documents and settings\All Users\Application Data\Intuit\Quicken\Inet\Common\patch\Update\QWPATCH.EXE 2009-10-27 23:59 . 2009-10-27 23:59 679936 ----a-w- c:\documents and settings\All Users\Application Data\Intuit\Quicken\Inet\Common\patch\Update\17175-17182.dll 2009-10-27 23:59 . 2009-10-27 23:59 585728 ----a-w- c:\documents and settings\All Users\Application Data\Intuit\Quicken\Inet\Common\patch\Update\171124-17122.dll 2009-10-27 23:59 . 2009-10-27 23:59 223584 ----a-w- c:\documents and settings\All Users\Application Data\Intuit\Quicken\Inet\Common\patch\Update\patchw32.dll 2009-10-27 23:59 . 2009-10-27 23:59 1008 ----a-w- c:\documents and settings\All Users\Application Data\Intuit\Quicken\Inet\Common\patch\Update\rebase.cmd 2009-10-21 05:38 . 2008-04-25 16:16 75776 ----a-w- c:\windows\system32\strmfilt.dll 2009-10-21 05:38 . 2008-04-25 16:16 25088 ----a-w- c:\windows\system32\httpapi.dll 2009-10-20 16:20 . 2008-04-14 00:23 265728 ----a-w- c:\windows\system32\drivers\http.sys 2009-10-13 10:30 . 2008-04-25 16:16 270336 ----a-w- c:\windows\system32\oakley.dll 2009-10-12 13:38 . 2008-04-25 16:16 149504 ----a-w- c:\windows\system32\rastls.dll 2009-10-12 13:38 . 2008-04-25 16:16 79872 ----a-w- c:\windows\system32\raschap.dll 2009-10-09 23:54 . 2009-10-09 23:54 77824 ----a-w- c:\windows\setpwr32.exe 2009-10-09 21:12 . 2009-10-25 14:56 33416 ----a-w- c:\documents and settings\Duane Pankhurst\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-10-09 21:08 . 2009-10-09 21:08 410984 ----a-w- c:\windows\system32\deploytk.dll 2009-10-09 21:01 . 2008-04-25 21:28 87263 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "@BackupScheduler"="c:\program files\Quicken\Online Backup\OnlineBackup.exe" [2009-10-30 611768] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RTHDCPL"="RTHDCPL.EXE" [2009-03-04 18084864] "PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2008-05-23 128296] "CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-15 644696] "CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-04 1603152] "SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472] "OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4\OpwareSE4.exe" [2007-02-04 79400] "IJNetworkScanUtility"="c:\program files\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE" [2007-05-21 124512] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-12-18 150040] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-12-18 178712] "Persistence"="c:\windows\system32\igfxpers.exe" [2008-12-18 150040] c:\documents and settings\Caledonia Pankhurst\Start Menu\Programs\Startup\ Dell Dock.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-6-30 1316192] c:\documents and settings\Shannon O'Conner\Start Menu\Programs\Startup\ Dell Dock.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-6-30 1316192] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys] @="FSFilter Activity Monitor" [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"= "c:\\WINDOWS\\system32\\mmc.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "c:\\WINDOWS\\system32\\fxsclnt.exe"= "c:\\Program Files\\BitTorrent\\bittorrent.exe"= "c:\\WINDOWS\\system32\\java.exe"= "c:\\Program Files\\Norton AntiVirus\\Norton AntiVirus\\Engine\\16.7.2.11\\ccSvcHst.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009 R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NAV\1007020.00B\SymEFA.sys [11/27/2009 4:02 PM 310320] R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\NAV\1007020.00B\BHDrvx86.sys [11/27/2009 4:02 PM 259632] R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NAV\1007020.00B\cchpx86.sys [11/27/2009 4:01 PM 482432] R1 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091217.002\IDSXpx86.sys [12/18/2009 2:41 PM 329592] R2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [12/18/2008 1:05 PM 155648] R2 Norton AntiVirus;Norton AntiVirus;c:\program files\Norton AntiVirus\Norton AntiVirus\Engine\16.7.2.11\ccSvcHst.exe [11/27/2009 4:01 PM 117640] R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [12/23/2009 10:48 AM 102448] . ------- Supplementary Scan ------- . uStart Page = hxxp://my.att.net/ . - - - - ORPHANS REMOVED - - - - Toolbar-Locked - (no file) SafeBoot-mcmscsvc SafeBoot-MCODS AddRemove-360Share Pro - c:\program files\360Share Pro\bt-uninst.exe ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-12-27 14:10 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... c:\docume~1\DUANEP~1\LOCALS~1\Temp\catchme.dll 53248 bytes executable scan completed successfully hidden files: 1 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Norton AntiVirus] "ImagePath"="\"c:\program files\Norton AntiVirus\Norton AntiVirus\Engine\16.7.2.11\ccSvcHst.exe\" /s \"Norton AntiVirus\" /m \"c:\program files\Norton AntiVirus\Norton AntiVirus\Engine\16.7.2.11\diMaster.dll\" /prefetch:1" . Completion time: 2009-12-27 14:11:30 ComboFix-quarantined-files.txt 2009-12-27 20:11 Pre-Run: 231,645,937,664 bytes free Post-Run: 231,621,652,480 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect - - End Of File - - 4ADAEF4DFC5E99646C17C64435D1C385