What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] i have been on this problem for 14 hours PLEASE SAVE M

28 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
i have a virus on my destop and cant run my norton antivirus or run any other antivirus cant run hijackthis or get online with it im on a friend laptop now thanks for any help
Post #2
Hello and welcome to Posted Image

Please be advised, as I am still in training, all my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advise.
This may cause a delay, but I will do my best to keep it as short as possible.

I will post back shortly with instructions.
Post #3
Hi iroc357


Follow these Instructions exactly.

Download this program to your friends computer.

Transfer the renamed program to your computers desktop via thumb drive or other media and run it.

Please download ComboFix from Here or Here to your Desktop.
**Note:  In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**
  • If you are using Firefox, make sure that your download settings are as follows:
    • Tools->Options->Main tab
    • Set to "Always ask me where to Save the files".
  • During the download, rename Combofix to Combo-Fix as follows:

    [external image: Posted Image]

    [external image: Posted Image]
  • It is important you rename Combofix during the download, but not after.
  • Please do not rename Combofix to other names, but only to the one indicated.
  • Close any open browsers.
  • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

    ———————————————————–

    • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
    • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

      ———————————————————–

    • Close any open browsers.
    • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
    • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

    ———————————————————–

  • Double click on combo-Fix.exe & follow the prompts.
  • When finished, it will produce a report for you.  
  • Please post the "C:\Combo-Fix.txt" along with a new HijackThis log for further review.
**Note: Do not mouseclick combo-fix's window while it's running. That may cause it to stall**
Post #4
ComboFix 09-02-19.01 - david childers 2009-02-20 16:02:59.1 - NTFSx86 MINIMAL
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.255.130 [GMT -5:00]
Running from: F:\Combo-Fix.exe
AV: Norton Internet Security *On-access scanning enabled* (Updated)
FW: Norton Internet Security *enabled*

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\2ACA5CC3-0F83-453D-A079-1076FE1A8B65
c:\documents and settings\All Users\Application Data\SeekmoSA
c:\documents and settings\All Users\Application Data\SeekmoSA\SeekmoSA.dat
c:\documents and settings\All Users\Application Data\SeekmoSA\SeekmoSA_kyf.dat
c:\documents and settings\All Users\Application Data\SeekmoSA\SeekmoSAAbout.mht
c:\documents and settings\All Users\Application Data\SeekmoSA\SeekmoSAau.dat
c:\documents and settings\All Users\Application Data\SeekmoSA\SeekmoSAEULA.mht
c:\documents and settings\All Users\Start Menu\Programs\Seekmo
c:\documents and settings\All Users\Start Menu\Programs\Seekmo\Reset Cursor.lnk
c:\documents and settings\All Users\Start Menu\Programs\Seekmo\Seekmo Customer Support Center.lnk
c:\documents and settings\All Users\Start Menu\Programs\Seekmo\Seekmo Uninstall Instructions.lnk
c:\documents and settings\david childers\Application Data\Seekmo
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\dynamic\2208948.sdf
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\dynamic\3852203.sdf
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\dynamic\625696.sdf
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\dynamic\641008.sdf
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\dynamic\890068.sdf
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\dynamic\domains.txt
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\dynamic\TooltipXML\12776
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\dynamic\TooltipXML\13620
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\dynamic\TooltipXML\142023
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\dynamic\TooltipXML\15626
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\dynamic\TooltipXML\169839
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\dynamic\TooltipXML\241998
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\dynamic\TooltipXML\251438
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\dynamic\TooltipXML\26664
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\dynamic\TooltipXML\27503
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\dynamic\TooltipXML\34186
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\dynamic\TooltipXML\34237
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\dynamic\TooltipXML\34513
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\dynamic\TooltipXML\42208
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\dynamic\TooltipXML\45833
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\dynamic\TooltipXML\565426
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\dynamic\TooltipXML\61779
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\dynamic\TooltipXML\61837
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\dynamic\TooltipXML\66836
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\dynamic\TooltipXML\749571
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\dynamic\TooltipXML\753363
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\dynamic\TooltipXML\753375
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\dynamic\TooltipXML\79382
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\dynamic\TooltipXML\81830
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\dynamic\TooltipXML\95716
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\dynamic\ustat\3740.dat
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\1\btntrans.idx
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\1\btntrans1.dat
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\1\buttondir.txt
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\1\components.cdf
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\1\cursors.res
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\1\d_icons_buttons_1000.res
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\1\d_icons_buttons_2000.res
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\1\d_icons_buttons_3000.res
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\1\d_icons_buttons_bar.res
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\1\d_icons_buttons_bbar1.res
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\1\d_icons_buttons_logos.res
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\1\d_icons_buttons_other.res
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\1\d_icons_weather.res
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\1\default.cdf
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\1\Default_511745-514279.mnu
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\1\Default_categorize.mnu
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\1\Default_comparison.mnu
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\1\Default_explorer-Mails.mnu
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\1\Default_explorer-people.mnu
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\1\Default_favorites.mnu
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\1\Default_Games.mnu
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\1\Default_Hide.mnu
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\1\Default_hotbarcom.mnu
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\1\Default_Hotmail.mnu
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\1\Default_hsskin.mnu
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\1\Default_Mails.mnu
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\1\Default_new.mnu
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\1\Default_premium.mnu
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\1\Default_searchfor.mnu
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\1\Default_searchgo.mnu
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\1\Default_weather.mnu
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\1\Default_yellowpages.mnu
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\1\email-def-511724-548964.mnu
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\1\email-def-511724-9595.mnu
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\1\email-t1-bg.res
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\1\icons2.res
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\1\ie_games_icon.res
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\1\ie_video.res
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\1\keywords.idx
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\1\keywords1.dat
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\1\layout.cdf
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\1\linkpathlegal.txt
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\1\progress.res
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\1\s_icons_buttons.res
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\1\sales_buttons.res
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\1\seekmo.res
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\1\seekmo_ie_menu.res
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\1\t2_bg.res
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\1\theweb.mnu
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\1\top7.cdf
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\1\Top7_theweb.mnu
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\1\tsd_bg.res
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\2\btntrans.idx
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\2\btntrans1.dat
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\2\buttondir.txt
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\2\components.cdf
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\2\cursors.res
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\2\d_icons_buttons_1000.res
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\2\d_icons_buttons_2000.res
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\2\d_icons_buttons_3000.res
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\2\d_icons_buttons_bar.res
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\2\d_icons_buttons_bbar1.res
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\2\d_icons_buttons_logos.res
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\2\d_icons_buttons_other.res
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\2\d_icons_weather.res
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\2\default.cdf
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\2\Default_511745-514279.mnu
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\2\Default_categorize.mnu
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\2\Default_comparison.mnu
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\2\Default_explorer-Mails.mnu
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\2\Default_explorer-people.mnu
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\2\Default_favorites.mnu
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\2\Default_Games.mnu
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\2\Default_Hide.mnu
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\2\Default_hotbarcom.mnu
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\2\Default_Hotmail.mnu
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\2\Default_hsskin.mnu
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\2\Default_Mails.mnu
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\2\Default_new.mnu
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\2\Default_premium.mnu
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\2\Default_searchfor.mnu
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\2\Default_searchgo.mnu
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\2\Default_weather.mnu
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\2\Default_yellowpages.mnu
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\2\email-def-511724-548964.mnu
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\2\email-def-511724-9595.mnu
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\2\email-t1-bg.res
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\2\icons2.res
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\2\ie_games_icon.res
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\2\ie_video.res
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\2\keywords.idx
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\2\keywords1.dat
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\2\layout.cdf
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\2\linkpathlegal.txt
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\2\progress.res
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\2\s_icons_buttons.res
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\2\sales_buttons.res
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\2\seekmo.res
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\2\seekmo_ie_menu.res
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\2\t2_bg.res
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\2\theweb.mnu
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\2\top7.cdf
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\2\Top7_theweb.mnu
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\2\tsd_bg.res
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\BtnTrans.xip
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\BtnTrans1.xip
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\buttondir.xip
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\cursors.xip
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\d_icons_buttons_1000.xip
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\d_icons_buttons_2000.xip
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\d_icons_buttons_3000.xip
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\d_icons_buttons_bar.xip
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\d_icons_buttons_bbar1.xip
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\d_icons_buttons_logos.xip
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\d_icons_buttons_other.xip
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\d_icons_weather.xip
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\default.xip
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\email-t1-bg.xip
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\icons2.xip
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\ie_games_icon.xip
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\ie_video.xip
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\keywords.xip
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\keywords1.xip
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\layout.xip
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\linkpathlegal.xip
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\progress.xip
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\s_icons_buttons.xip
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\sales_buttons.xip
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\samplegroups2.txt
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\samplegroups2.xip
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\seekmo.xip
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\seekmo_ie_menu.xip
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\t2_bg.xip
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\top7.xip
c:\documents and settings\david childers\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\tsd_bg.xip
c:\documents and settings\Guest\Application Data\Hotbar
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\1.sdf
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\1385372.sdf
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\691517.sdf
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\ASPL1.dat
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\domains.txt
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\17025
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\22139
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\23175
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\366238
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\400633
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\44878
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\45833
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\48069
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\54239
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\66908
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\67226
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\703336
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\86379
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\97172
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\ustat\31e7.dat
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\ads.cdf
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\business_promo.htm
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\buttondir.txt
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\components.cdf
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\d_icons_buttons_1000.res
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\d_icons_buttons_2000.res
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\d_icons_buttons_3000.res
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\d_icons_buttons_bar.res
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\d_icons_buttons_bbar1.res
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\d_icons_buttons_bbar10.res
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\d_icons_buttons_bbar11.res
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\d_icons_buttons_bbar12.res
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\d_icons_buttons_bbar13.res
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\d_icons_buttons_bbar14.res
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\d_icons_buttons_bbar2.res
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\d_icons_buttons_bbar3.res
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\d_icons_buttons_bbar4.res
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\d_icons_buttons_bbar5.res
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\d_icons_buttons_bbar6.res
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\d_icons_buttons_bbar7.res
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\d_icons_buttons_bbar8.res
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\d_icons_buttons_bbar9.res
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\d_icons_buttons_logos.res
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\d_icons_buttons_other.res
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\d_icons_buttons_x.res
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\d_icons_weather.res
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\default.cdf
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\Default_511745-514279.mnu
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\Default_categorize.mnu
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\Default_comparison.mnu
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\Default_explorer-Mails.mnu
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\Default_explorer-people.mnu
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\Default_favorites.mnu
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\Default_Games.mnu
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\Default_Hide.mnu
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\Default_hotbarcom.mnu
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\Default_Hotmail.mnu
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\Default_hsskin.mnu
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\Default_Mails.mnu
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\Default_new.mnu
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\Default_premium.mnu
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\Default_ringtone.mnu
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\Default_SearchBoxTrapper.mnu
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\Default_searchfor.mnu
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\Default_searchgo.mnu
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\Default_weather.mnu
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\Default_yellowpages.mnu
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\email-def-511724-9595.mnu
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\email-t1-bg.res
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\hotbar-premium-hotbar-premium.mnu
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\hotbar-premium.cdf
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\hotbar_promo.htm
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\icons2.res
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\keywords.idx
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\keywords_idx.idx
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\keywords_sdf.sdf
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\keywords1.dat
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\layout.cdf
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\linkpathlegal.txt
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\progress.res
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\s_icons_buttons.res
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\t2_bg.res
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\theweb.mnu
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\top7.cdf
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\Top7_theweb.mnu
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\tsd_bg.res
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\ads.xip
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\business_promo.xip
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\buttondir.xip
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\d_icons_buttons_1000.xip
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\d_icons_buttons_2000.xip
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\d_icons_buttons_3000.xip
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\d_icons_buttons_bar.xip
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\d_icons_buttons_bbar1.xip
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\d_icons_buttons_bbar10.xip
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\d_icons_buttons_bbar11.xip
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\d_icons_buttons_bbar12.xip
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\d_icons_buttons_bbar13.xip
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\d_icons_buttons_bbar14.xip
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\d_icons_buttons_bbar2.xip
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\d_icons_buttons_bbar3.xip
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\d_icons_buttons_bbar4.xip
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\d_icons_buttons_bbar5.xip
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\d_icons_buttons_bbar6.xip
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\d_icons_buttons_bbar7.xip
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\d_icons_buttons_bbar8.xip
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\d_icons_buttons_bbar9.xip
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\d_icons_buttons_logos.xip
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\d_icons_buttons_other.xip
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\d_icons_buttons_x.xip
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\d_icons_weather.xip
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\default.xip
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\email-t1-bg.xip
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\hotbar-premium.xip
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\hotbar_promo.xip
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\icons2.xip
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\keywords.xip
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\keywords_idx.xip
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\keywords_sdf.xip
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\keywords1.xip
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\layout.xip
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\linkpathlegal.xip
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\progress.xip
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\s_icons_buttons.xip
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\samplegroups2.txt
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\samplegroups2.xip
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\t2_bg.xip
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\top7.xip
c:\documents and settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\tsd_bg.xip
c:\program files\Seekmo Programs
c:\program files\Seekmo Programs\Seekmo Toolbar\SeekmoTBUninstaller.exe
c:\program files\TBONAS
c:\program files\TBONAS\bestoffers_icon_01.ico
c:\program files\TBONAS\center_wnd.htm
c:\program files\TBONAS\comp.htm
c:\program files\TBONAS\grb12.rtk
c:\windows\IE4 Error Log.txt
c:\windows\inf\MSView.inf
c:\windows\Readme.txt
c:\windows\system32\ccdacecfbddee.dll
c:\windows\system32\uninstall.exe
c:\windows\system32\vumer.dll
F:\autorun.inf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_SVCPROC


((((((((((((((((((((((((( Files Created from 2009-01-20 to 2009-02-20 )))))))))))))))))))))))))))))))
.

2009-02-20 04:38 . 2006-12-29 00:31 19,569 –a—— c:\windows\000001_.tmp
2009-02-20 04:02 . 2009-02-20 04:02 d——– c:\windows\SYSTEM32\CatRoot_bak
2009-02-19 19:44 . 2009-02-19 19:44 10,344 –a—— c:\windows\SYSTEM32\DRIVERS\symlcbrd.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-20 03:16 ——— d—–w c:\program files\PhoneTools
2009-02-20 03:14 ——— d—–w c:\program files\Home Improvement
2009-02-20 01:57 ——— d—–w c:\documents and settings\All Users\Application Data\Symantec
2009-02-10 22:30 ——— d—–w c:\documents and settings\david childers\Application Data\WeatherBug
2009-02-03 03:30 ——— d—–w c:\program files\Common Files\Symantec Shared
2009-01-13 23:58 9,088 —hatw c:\windows\system32\drivers\CrucialSMBusScan.sys
2009-01-13 22:33 ——— d—–w c:\documents and settings\david childers\Application Data\U3
2009-01-13 00:48 ——— d—–w c:\program files\Google
2009-01-09 03:33 ——— d—–w c:\program files\Symantec
2009-01-09 03:32 806 —-a-w c:\windows\system32\drivers\SYMEVENT.INF
2009-01-09 03:32 124,464 —-a-w c:\windows\system32\drivers\SYMEVENT.SYS
2009-01-09 03:32 10,635 —-a-w c:\windows\system32\drivers\SYMEVENT.CAT
2005-09-21 18:23 104,752 —-a-w c:\documents and settings\david childers\Application Data\GDIPFONTCACHEV1.DAT
2002-03-21 22:40 25 —-a-w c:\program files\qse.ini
2002-03-12 04:15 416,167 —-a-w c:\program files\Uninst.isu
2001-02-07 18:47 43,428 —-a-w c:\program files\license.htm
2001-02-01 17:09 70,837 —-a-w c:\program files\quicken.cnt
2001-02-01 17:09 7,105 —-a-w c:\program files\errata.hlp
2001-02-01 17:09 428 —-a-w c:\program files\errata.cnt
2001-02-01 17:09 36,864 —-a-w c:\program files\qwver.dll
2001-02-01 17:09 207,436 —-a-w c:\program files\planhelp.hlp
2001-02-01 17:09 155,885 —-a-w c:\program files\pnf.hlp
2001-02-01 17:09 10,240 —-a-w c:\program files\MVUT14N.DLL
2001-02-01 17:09 1,506,423 —-a-w c:\program files\quicken.hlp
2000-11-09 13:41 749,568 —-a-w c:\program files\ttaximp.dll
2000-11-07 15:21 7,115 —-a-w c:\program files\ttaxexpt.dat
2000-10-10 16:06 29 —-a-w c:\program files\toolbar.ini
2000-09-19 22:36 51 —-a-w c:\program files\QAppID.ini
2000-09-19 19:36 3,033,651 —-a-w c:\program files\host.exe
2000-05-31 19:20 57,856 —-a-w c:\program files\mrtProc.dll
2000-05-31 19:20 104,448 —-a-w c:\program files\mrbUpd.dll
1999-04-30 21:00 98,304 ——w c:\program files\internet explorer\plugins\UPjpeg.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9B60F591-27B6-42D3-92BD-22B6CDF27979}]
2003-03-15 19:48 385024 –a—— c:\windows\SYSTEM32\m030206pohs.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MoneyAgent"="c:\program files\Microsoft Money\System\Money Express.exe" [2001-07-25 184376]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"Weather"="c:\progra~1\AWS\WEATHE~1\Weather.exe" [2005-06-07 1339392]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-14 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-10-17 51048]

c:\documents and settings\david childers\Start Menu\Programs\Startup\
PowerReg Scheduler.exe [2002-02-22 256000]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Camio Viewer 2000.lnk - c:\program files\Sierra Imaging\Image Expert 2000\IXApplet.exe [2002-02-14 49152]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]
PowerReg Scheduler.exe [2002-02-22 256000]
RealDownload.lnk - c:\program files\Real\RealDownload\Realdownload.exe [2005-09-07 20516]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{EDB0E980-90BD-11D4-8599-0008C7D3B6F8}"= "c:\progra~1\Qualcomm\Eudora\EuShlExt.dll" [2001-04-12 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.ctmp3"= c:\windows\System32\ctmp3.acm
"aux1"= ctwdm32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R0 355ede17db8e2cebcfae1bc6ca9f6eee;355ede17db8e2cebcfae1bc6ca9f6eee; [x]
R2 LiveUpdate Notice;LiveUpdate Notice;c:\program files\Common Files\Symantec Shared\ccSvcHst.exe [2008-10-17 149352]
R3 COH_Mon;COH_Mon;c:\windows\system32\Drivers\COH_Mon.sys [2008-07-30 23888]
S2 Nhksrv;Netropa NHK Server;c:\windows\Nhksrv.exe [2001-08-06 28672]
S2 tcaicchg;tcaicchg;c:\windows\System32\tcaicchg.sys [2000-06-06 21233]
S2 TCAITDI;TCAITDI Protocol;c:\windows\system32\DRIVERS\TCAITDI.sys [2001-09-04 19534]
S2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2007-01-04 24652]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2008-12-17 99376]
S3 Msikbd2k;DellTouch;c:\windows\system32\DRIVERS\msikbd2k.sys [2000-10-03 6942]


— Other Services/Drivers In Memory —

*NewlyCreated* - COMHOST
*Deregistered* - abp480n5
*Deregistered* - adpu160m
*Deregistered* - AFD
*Deregistered* - agpCPQ
*Deregistered* - Aha154x
*Deregistered* - aic78u2
*Deregistered* - aic78xx
*Deregistered* - ALG
*Deregistered* - AliIde
*Deregistered* - alim1541
*Deregistered* - amdagp
*Deregistered* - amsint
*Deregistered* - asc
*Deregistered* - asc3350p
*Deregistered* - asc3550
*Deregistered* - ASCTRM
*Deregistered* - AudioSrv
*Deregistered* - audstub
*Deregistered* - Automatic LiveUpdate Scheduler
*Deregistered* - Beep
*Deregistered* - BITS
*Deregistered* - Browser
*Deregistered* - cbidf
*Deregistered* - cd20xrnt
*Deregistered* - Cdfs
*Deregistered* - cdudf_xp
*Deregistered* - CLTNetCnService
*Deregistered* - CmdIde
*Deregistered* - CO_Mon
*Deregistered* - comHost
*Deregistered* - Cpqarray
*Deregistered* - Creative Service for CDROM Access
*Deregistered* - CryptSvc
*Deregistered* - dac2w2k
*Deregistered* - dac960nt
*Deregistered* - DcomLaunch
*Deregistered* - Dhcp
*Deregistered* - Dnscache
*Deregistered* - dpti2o
*Deregistered* - eeCtrl
*Deregistered* - emu10k1
*Deregistered* - EraserUtilRebootDrv
*Deregistered* - ERSvc
*Deregistered* - EventSystem
*Deregistered* - Fallback
*Deregistered* - Fastfat
*Deregistered* - FastUserSwitchingCompatibility
*Deregistered* - Fips
*Deregistered* - FltMgr
*Deregistered* - Fsks
*Deregistered* - Ftdisk
*Deregistered* - Gpc
*Deregistered* - helpsvc
*Deregistered* - hpn
*Deregistered* - hpt3xx
*Deregistered* - HTTP
*Deregistered* - i2omgmt
*Deregistered* - i2omp
*Deregistered* - ImapiService
*Deregistered* - ini910u
*Deregistered* - IpNat
*Deregistered* - IPSec
*Deregistered* - K56
*Deregistered* - KSecDD
*Deregistered* - lanmanserver
*Deregistered* - lanmanworkstation
*Deregistered* - LmHosts
*Deregistered* - MDM
*Deregistered* - mmc_2K
*Deregistered* - mnmdd
*Deregistered* - MountMgr
*Deregistered* - mraid35x
*Deregistered* - MRxDAV
*Deregistered* - MRxSmb
*Deregistered* - Msfs
*Deregistered* - mssmbios
*Deregistered* - Mup
*Deregistered* - NAVENG
*Deregistered* - NAVEX15
*Deregistered* - NDIS
*Deregistered* - NdisTapi
*Deregistered* - Ndisuio
*Deregistered* - NdisWan
*Deregistered* - NDProxy
*Deregistered* - NetBIOS
*Deregistered* - NetBT
*Deregistered* - Netman
*Deregistered* - Nhksrv
*Deregistered* - Nla
*Deregistered* - Npfs
*Deregistered* - Ntfs
*Deregistered* - Null
*Deregistered* - NVSvc
*Deregistered* - PartMgr
*Deregistered* - ParVdm
*Deregistered* - PCIIde
*Deregistered* - perc2
*Deregistered* - perc2hib
*Deregistered* - PfModNT
*Deregistered* - PolicyAgent
*Deregistered* - PptpMiniport
*Deregistered* - ProtectedStorage
*Deregistered* - PSched
*Deregistered* - ql1080
*Deregistered* - Ql10wnt
*Deregistered* - ql12160
*Deregistered* - ql1240
*Deregistered* - ql1280
*Deregistered* - RasAcd
*Deregistered* - Rasl2tp
*Deregistered* - RasMan
*Deregistered* - RasPppoe
*Deregistered* - Raspti
*Deregistered* - Rdbss
*Deregistered* - RDPCDD
*Deregistered* - RpcSs
*Deregistered* - SamSs
*Deregistered* - Schedule
*Deregistered* - seclogon
*Deregistered* - SENS
*Deregistered* - sfman
*Deregistered* - SharedAccess
*Deregistered* - ShellHWDetection
*Deregistered* - sisagp
*Deregistered* - SoftFax
*Deregistered* - Sparrow
*Deregistered* - SpeakerPhone
*Deregistered* - Spooler
*Deregistered* - sr
*Deregistered* - srservice
*Deregistered* - SRTSP
*Deregistered* - SRTSPX
*Deregistered* - Srv
*Deregistered* - SSDPSRV
*Deregistered* - stisvc
*Deregistered* - swenum
*Deregistered* - sym_hi
*Deregistered* - sym_u3
*Deregistered* - Symantec Core LC
*Deregistered* - symc810
*Deregistered* - symc8xx
*Deregistered* - SYMDNS
*Deregistered* - SymEvent
*Deregistered* - SYMFW
*Deregistered* - SYMIDS
*Deregistered* - SYMIDSCO
*Deregistered* - SymIMMP
*Deregistered* - SYMNDIS
*Deregistered* - SYMREDRV
*Deregistered* - SYMTDI
*Deregistered* - TapiSrv
*Deregistered* - tcaicchg
*Deregistered* - TCAITDI
*Deregistered* - Tcpip
*Deregistered* - TermDD
*Deregistered* - TermService
*Deregistered* - Themes
*Deregistered* - Tones
*Deregistered* - TosIde
*Deregistered* - TrkWks
*Deregistered* - UdfReadr_xp
*Deregistered* - ultra
*Deregistered* - Update
*Deregistered* - V124
*Deregistered* - VgaSave
*Deregistered* - viaagp
*Deregistered* - ViaIde
*Deregistered* - Viewpoint Manager Service
*Deregistered* - VolSnap
*Deregistered* - W32Time
*Deregistered* - Wanarp
*Deregistered* - WebClient
*Deregistered* - winmgmt
*Deregistered* - WMDM PMSP Service
*Deregistered* - wscsvc
*Deregistered* - wuauserv
*Deregistered* - WZCSVC

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL INDEX.html
.
Contents of the 'Scheduled Tasks' folder

2009-02-17 c:\windows\Tasks\Norton Internet Security - Run Full System Scan - david childers.job
- c:\program files\Norton Internet Security\Norton AntiVirus\Navw32.exe [2007-08-26 20:19]
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-msnmsgr - c:\program files\MSN Messenger\msnmsgr.exe


.
——- Supplementary Scan ——-
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: {{47055D63-DFCD-11d3-8406-00500445A7D1} - c:\windows\System32\windialup\2411[1]\windialup.exe
Name-Space Handler: ftp\RealDownload - {EBCDDA5E-2A68-11D3-8A43-0060083CFB9C} - c:\windows\SYSTEM32\nzdd.dll
Name-Space Handler: http\RealDownload - {EBCDDA5E-2A68-11D3-8A43-0060083CFB9C} - c:\windows\SYSTEM32\nzdd.dll
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-20 16:13:26
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-1194005503-2805738209-4071888707-1007\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_LOCAL_MACHINE\software\Classes\giffile\shell\Open\ddeexec]
@DACL=(02 0000)
@="\"file:%1\",,-1,,,,,"
.
———————— Other Running Processes ————————
.
c:\progra~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe
c:\windows\SYSTEM32\CTSVCCDA.EXE
c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\windows\SYSTEM32\nvsvc32.exe
c:\windows\SYSTEM32\MsPMSPSv.exe
c:\windows\SYSTEM32\devldr32.exe
c:\program files\Viewpoint\Viewpoint Manager\ViewMgr.exe
.
**************************************************************************
.
Completion time: 2009-02-20 16:23:00 - machine was rebooted
ComboFix-quarantined-files.txt 2009-02-20 21:22:53

Pre-Run: 64,412,672,000 bytes free
Post-Run: 64,158,257,152 bytes free

657 — E O F — 2009-02-20 20:36:18
Post #6
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:02:07 PM, on 2/20/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Nhksrv.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\AWS\WEATHE~1\Weather.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: My Web Search Bar BHO - {8EAB99C1-F9EC-4b64-A4BA-D9BCAE8779C2} - C:\Program Files\MyWebSearchWB\bar\1.bin\W6BAR.DLL
O2 - BHO: IEHlprObj Class - {9B60F591-27B6-42D3-92BD-22B6CDF27979} - C:\WINDOWS\SYSTEM32\m030206pohs.dll
O2 - BHO: Viewpoint Toolbar BHO - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\Program Files\Viewpoint\Viewpoint Toolbar\3.8.0\ViewBarBHO.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: BrowserHelper Class - {EBCDDA60-2A68-11D3-8A43-0060083CFB9C} - C:\WINDOWS\system32\nzdd.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll
O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.8.0\IEViewBar.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Weather] C:\PROGRA~1\AWS\WEATHE~1\Weather.exe 1
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Startup: PowerReg Scheduler.exe
O4 - Global Startup: Camio Viewer 2000.lnk = C:\Program Files\Sierra Imaging\Image Expert 2000\IXApplet.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: PowerReg Scheduler.exe
O4 - Global Startup: RealDownload.lnk = C:\Program Files\Real\RealDownload\Realdownload.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Enjoy It - {47055D63-DFCD-11d3-8406-00500445A7D1} - C:\WINDOWS\System32\windialup\2411[1]\windialup.exe (file missing)
O9 - Extra 'Tools' menuitem: Enjoy It - {47055D63-DFCD-11d3-8406-00500445A7D1} - C:\WINDOWS\System32\windialup\2411[1]\windialup.exe (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.av.aol.com/molbin/shared/m…83/mcinsctl.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1136785131515
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.av.aol.com/molbin/shared/m…,20/mcgdmgr.cab
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Netropa NHK Server (Nhksrv) - Unknown owner - C:\WINDOWS\Nhksrv.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

–
End of file - 8948 bytes
Post #8
Hi iroc357,

You did not mention how your machine is running after the ComboFix run - are you now able to access the internet and are you now able to run your antivirus program?


Please do the following:

  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
  • They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box,Press Ctrl+C (or right click on the highlighted section and choose 'copy')

KillAll::

File::
C:\WINDOWS\000001_.tmp
c:\windows\System32\windialup\2411[1]\windialup.exe
C:\WINDOWS\SYSTEM32\m030206pohs.dll

Folder::
c:\documents and settings\david childers\Application Data\WeatherBug
C:\Program Files\MyWebSearchWB

Registry::
O2 - BHO: My Web Search Bar BHO - {8EAB99C1-F9EC-4b64-A4BA-D9BCAE8779C2} - C:\Program Files\MyWebSearchWB\bar\1.bin\W6BAR.DLL
O2 - BHO: IEHlprObj Class - {9B60F591-27B6-42D3-92BD-22B6CDF27979} - C:\WINDOWS\SYSTEM32\m030206pohs.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O9 - Extra button: Enjoy It - {47055D63-DFCD-11d3-8406-00500445A7D1} - C:\WINDOWS\System32\windialup\2411[1]\windialup.exe (file missing)
O9 - Extra 'Tools' menuitem: Enjoy It - {47055D63-DFCD-11d3-8406-00500445A7D1} - C:\WINDOWS\System32\windialup\2411[1]\windialup.exe (file missing)
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]

Driver::
355ede17db8e2cebcfae1bc6ca9f6eee

Now paste the copied text into the open notepad. Press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]

* Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
* ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
* When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.


NEXT:

Please download the GMER Rootkit Scanner. Unzip it to your Desktop.
Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.
Double-click gmer.exe. The program will begin to run.
**Caution**
These types of scans can produce false positives. Do NOT take any action on any "<— ROOKIT" entries unless advised!
If possible rootkit activity is found, you will be asked if you would like to perform a full scan.
  • Click NO
  • In the right panel, you will see a number of boxes that have been checked … leave everything checked and ensure the Show all box is un-checked.
  • Now click the Scan button.
    Once the scan is complete, you may receive another notice about rootkit activity.
  • Click OK.
  • GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "GMER.txt"
  • Save it where you can easily find it, such as your desktop.
  • Post the contents of GMER.txt in your next reply.


In your next reply I need
  • ComboFix log
  • GMER log
  • Fresh HJT log

Please also advise how your computer is behaving now.
Post #9
i cant access my norton to disable it , would it be better to just reinstall windows i dont care about whats on it and it is a little better i can run programs now, still no internet and cant access my norton
Post #10

would it be better to just reinstall windows


That's entirely your choice - did you run the above instructions - try them - see how it goes - I feel we are getting there and will likely have you back on line soon.

Let me know your decision.
Post #12 last edited

is it okay to run them with noton runin


Yes - it looks like the infection has disabled your Norton anyway

also try this -

Start > Run > copy/paste msconfig into the runbox > Enter
Select - StartUp Tab - Enable all
Select - Services Tab - enable all

see if that helps you get back on line

let us know how you get on.

Be sure to copy the combofix log in your next reply
Post #13
here is the combofix log

ComboFix 09-02-19.01 - david childers 2009-02-21 12:41:44.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.255.33 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\david childers\Desktop\CFScript.txt
AV: Norton Internet Security *On-access scanning enabled* (Updated)
FW: Norton Internet Security *enabled*
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
c:\windows\000001_.tmp
c:\windows\SYSTEM32\m030206pohs.dll
c:\windows\System32\windialup\2411[1]\windialup.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\MyWebSearchWB
c:\program files\MyWebSearchWB\bar\1.bin\NPMYSRWB.DLL
c:\program files\MyWebSearchWB\bar\1.bin\W6BAR.DLL
c:\program files\MyWebSearchWB\bar\1.bin\W6FFXTBR.JAR
c:\program files\MyWebSearchWB\bar\1.bin\W6NTSTBR.JAR
c:\program files\MyWebSearchWB\bar\1.bin\W6PLUGIN.DLL
c:\program files\MyWebSearchWB\bar\1.bin\W6WBTEMP.DLL
c:\program files\MyWebSearchWB\bar\Cache\000477FB
c:\program files\MyWebSearchWB\bar\Cache\0004D137.bin
c:\program files\MyWebSearchWB\bar\Cache\0004FCFA
c:\program files\MyWebSearchWB\bar\Cache\000556D2.bin
c:\program files\MyWebSearchWB\bar\Cache\00061E58.bin
c:\program files\MyWebSearchWB\bar\Cache\000AA8C2.bin
c:\program files\MyWebSearchWB\bar\Cache\000B28EF.bin
c:\program files\MyWebSearchWB\bar\Cache\000B3831
c:\program files\MyWebSearchWB\bar\Cache\00138F33.bin
c:\program files\MyWebSearchWB\bar\Cache\002A3ACA.bin
c:\program files\MyWebSearchWB\bar\Cache\005F4538.bin
c:\program files\MyWebSearchWB\bar\Cache\005F99E0
c:\program files\MyWebSearchWB\bar\Cache\00637B58.bin
c:\program files\MyWebSearchWB\bar\Cache\006DF9EE.bin
c:\program files\MyWebSearchWB\bar\Cache\0098C4B4.bin
c:\program files\MyWebSearchWB\bar\Cache\00A9E316.bin
c:\program files\MyWebSearchWB\bar\Cache\00AA77C5.bin
c:\program files\MyWebSearchWB\bar\Cache\00B4647B.bin
c:\program files\MyWebSearchWB\bar\Cache\00FB630A.bin
c:\program files\MyWebSearchWB\bar\Cache\01112673.bin
c:\program files\MyWebSearchWB\bar\Cache\0111D83F.bin
c:\program files\MyWebSearchWB\bar\Cache\016B72C9.bin
c:\program files\MyWebSearchWB\bar\Cache\019337E0.bin
c:\program files\MyWebSearchWB\bar\Cache\021B22DC
c:\program files\MyWebSearchWB\bar\Cache\021B25AA
c:\program files\MyWebSearchWB\bar\Cache\021B26A4.bin
c:\program files\MyWebSearchWB\bar\Cache\021B426A.bin
c:\program files\MyWebSearchWB\bar\Cache\02602F6F.bin
c:\program files\MyWebSearchWB\bar\Cache\027E538F.bin
c:\program files\MyWebSearchWB\bar\Cache\0282ED99.bin
c:\program files\MyWebSearchWB\bar\Cache\029B6814.bin
c:\program files\MyWebSearchWB\bar\Cache\02D5D616.bin
c:\program files\MyWebSearchWB\bar\Cache\02ECEF99.bin
c:\program files\MyWebSearchWB\bar\Cache\02EF3F84.bin
c:\program files\MyWebSearchWB\bar\Cache\02F1106C.bin
c:\program files\MyWebSearchWB\bar\Cache\02F111B4.bin
c:\program files\MyWebSearchWB\bar\Cache\02F646C6.bin
c:\program files\MyWebSearchWB\bar\Cache\03098384.bin
c:\program files\MyWebSearchWB\bar\Cache\031B3889.bin
c:\program files\MyWebSearchWB\bar\Cache\03617E87.bin
c:\program files\MyWebSearchWB\bar\Cache\03AD7CD0.bin
c:\program files\MyWebSearchWB\bar\Cache\03BF7602.bin
c:\program files\MyWebSearchWB\bar\Cache\03BF772B.bin
c:\program files\MyWebSearchWB\bar\Cache\03BF77D7.bin
c:\program files\MyWebSearchWB\bar\Cache\03D28538.bin
c:\program files\MyWebSearchWB\bar\Cache\03F99A0A.bin
c:\program files\MyWebSearchWB\bar\Cache\047549AD.bin
c:\program files\MyWebSearchWB\bar\Cache\048B2AEF.bin
c:\program files\MyWebSearchWB\bar\Cache\04A6A6C3.bin
c:\program files\MyWebSearchWB\bar\Cache\04A6A7AD.bin
c:\program files\MyWebSearchWB\bar\Cache\04AF0F0B.bin
c:\program files\MyWebSearchWB\bar\Cache\04BEDBC8.bin
c:\program files\MyWebSearchWB\bar\Cache\04C87DE8.bin
c:\program files\MyWebSearchWB\bar\Cache\04C87ED3.bin
c:\program files\MyWebSearchWB\bar\Cache\04E1CE9F.bin
c:\program files\MyWebSearchWB\bar\Cache\04F165A6
c:\program files\MyWebSearchWB\bar\Cache\05251566.bin
c:\program files\MyWebSearchWB\bar\Cache\05383BAF.bin
c:\program files\MyWebSearchWB\bar\Cache\053C23AF.bin
c:\program files\MyWebSearchWB\bar\Cache\0622052B.bin
c:\program files\MyWebSearchWB\bar\Cache\063806C6.bin
c:\program files\MyWebSearchWB\bar\Cache\063807C0.bin
c:\program files\MyWebSearchWB\bar\Cache\0638085D.bin
c:\program files\MyWebSearchWB\bar\Cache\0656B719.bin
c:\program files\MyWebSearchWB\bar\Cache\06B21D2B.bin
c:\program files\MyWebSearchWB\bar\Cache\070CF19C.bin
c:\program files\MyWebSearchWB\bar\Cache\07E18402.bin
c:\program files\MyWebSearchWB\bar\Cache\080E39EE.bin
c:\program files\MyWebSearchWB\bar\Cache\08B8DF6A.bin
c:\program files\MyWebSearchWB\bar\Cache\08BCE6E9.bin
c:\program files\MyWebSearchWB\bar\Cache\09660354.bin
c:\program files\MyWebSearchWB\bar\Cache\0A22DAB7.bin
c:\program files\MyWebSearchWB\bar\Cache\0ABFFAB6.bin
c:\program files\MyWebSearchWB\bar\Cache\0AC16DDE
c:\program files\MyWebSearchWB\bar\Cache\0B195E42.bin
c:\program files\MyWebSearchWB\bar\Cache\0CA4F0FB
c:\program files\MyWebSearchWB\bar\Cache\0CF25F10.bin
c:\program files\MyWebSearchWB\bar\Cache\0D9CFF4D.bin
c:\program files\MyWebSearchWB\bar\Cache\0F9B25FE.bin
c:\program files\MyWebSearchWB\bar\Cache\105A7DC2.bin
c:\program files\MyWebSearchWB\bar\Cache\10ED6628.bin
c:\program files\MyWebSearchWB\bar\Cache\10FDB4C7.bin
c:\program files\MyWebSearchWB\bar\Cache\11EC357B.bin
c:\program files\MyWebSearchWB\bar\Cache\13A18497.bin
c:\program files\MyWebSearchWB\bar\Cache\14FE7719.bin
c:\program files\MyWebSearchWB\bar\Cache\1919C2EF.bin
c:\program files\MyWebSearchWB\bar\Cache\19A962E0.bin
c:\program files\MyWebSearchWB\bar\Cache\1AECF3C3.bin
c:\program files\MyWebSearchWB\bar\Cache\1CD975CB.bin
c:\program files\MyWebSearchWB\bar\Cache\1CD976C5.bin
c:\program files\MyWebSearchWB\bar\Cache\1CD97752.bin
c:\program files\MyWebSearchWB\bar\Cache\1CD977EE.bin
c:\program files\MyWebSearchWB\bar\Cache\1CD978E8.bin
c:\program files\MyWebSearchWB\bar\Cache\1CD97975.bin
c:\program files\MyWebSearchWB\bar\Cache\1CD97A40.bin
c:\program files\MyWebSearchWB\bar\Cache\234E73DF.bin
c:\program files\MyWebSearchWB\bar\Cache\234E81AA.bin
c:\program files\MyWebSearchWB\bar\Cache\234E8DFE.bin
c:\program files\MyWebSearchWB\bar\Cache\35D49CDA.bin
c:\program files\MyWebSearchWB\bar\Cache\363BD1A1.bin
c:\program files\MyWebSearchWB\bar\Cache\3BD34B26.bin
c:\program files\MyWebSearchWB\bar\Cache\43AFD5F6.bin
c:\program files\MyWebSearchWB\bar\Cache\4ACC48D0.bin
c:\program files\MyWebSearchWB\bar\Cache\75261F21.bin
c:\program files\MyWebSearchWB\bar\Cache\files.ini
c:\program files\MyWebSearchWB\bar\History\search
c:\program files\MyWebSearchWB\bar\Settings\prevcfg.htm
c:\windows\000001_.tmp

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_355EDE17DB8E2CEBCFAE1BC6CA9F6EEE
——-\Service_355ede17db8e2cebcfae1bc6ca9f6eee


((((((((((((((((((((((((( Files Created from 2009-01-21 to 2009-02-21 )))))))))))))))))))))))))))))))
.

2009-02-21 12:38 . 2009-02-21 12:39 d——– C:\32788R22FWJFW
2009-02-20 18:01 . 2009-02-20 18:01 d——– c:\program files\Trend Micro
2009-02-20 17:44 . 2009-02-20 17:44 d——– c:\program files\Malwarebytes' Anti-Malware
2009-02-20 17:44 . 2009-02-20 17:44 d——– c:\documents and settings\david childers\Application Data\Malwarebytes
2009-02-20 17:44 . 2009-02-20 17:44 d——– c:\documents and settings\All Users\Application Data\Malwarebytes
2009-02-20 17:44 . 2008-10-22 16:10 38,496 –a—— c:\windows\SYSTEM32\DRIVERS\mbamswissarmy.sys
2009-02-20 17:44 . 2008-10-22 16:10 15,504 –a—— c:\windows\SYSTEM32\DRIVERS\mbam.sys
2009-02-20 04:02 . 2009-02-20 04:02 d——– c:\windows\SYSTEM32\CatRoot_bak
2009-02-19 19:44 . 2009-02-19 19:44 10,344 –a—— c:\windows\SYSTEM32\DRIVERS\symlcbrd.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-20 03:16 ——— d—–w c:\program files\PhoneTools
2009-02-20 03:14 ——— d—–w c:\program files\Home Improvement
2009-02-20 01:57 ——— d—–w c:\documents and settings\All Users\Application Data\Symantec
2009-02-10 22:30 ——— d—–w c:\documents and settings\david childers\Application Data\WeatherBug
2009-02-03 03:30 ——— d—–w c:\program files\Common Files\Symantec Shared
2009-01-13 23:58 9,088 —hatw c:\windows\system32\drivers\CrucialSMBusScan.sys
2009-01-13 22:33 ——— d—–w c:\documents and settings\david childers\Application Data\U3
2009-01-13 00:48 ——— d—–w c:\program files\Google
2009-01-09 03:33 ——— d—–w c:\program files\Symantec
2009-01-09 03:32 806 —-a-w c:\windows\system32\drivers\SYMEVENT.INF
2009-01-09 03:32 124,464 —-a-w c:\windows\system32\drivers\SYMEVENT.SYS
2009-01-09 03:32 10,635 —-a-w c:\windows\system32\drivers\SYMEVENT.CAT
2005-09-21 18:23 104,752 —-a-w c:\documents and settings\david childers\Application Data\GDIPFONTCACHEV1.DAT
2002-03-21 22:40 25 —-a-w c:\program files\qse.ini
2002-03-12 04:15 416,167 —-a-w c:\program files\Uninst.isu
2001-02-07 18:47 43,428 —-a-w c:\program files\license.htm
2001-02-01 17:09 70,837 —-a-w c:\program files\quicken.cnt
2001-02-01 17:09 7,105 —-a-w c:\program files\errata.hlp
2001-02-01 17:09 428 —-a-w c:\program files\errata.cnt
2001-02-01 17:09 36,864 —-a-w c:\program files\qwver.dll
2001-02-01 17:09 207,436 —-a-w c:\program files\planhelp.hlp
2001-02-01 17:09 155,885 —-a-w c:\program files\pnf.hlp
2001-02-01 17:09 10,240 —-a-w c:\program files\MVUT14N.DLL
2001-02-01 17:09 1,506,423 —-a-w c:\program files\quicken.hlp
2000-11-09 13:41 749,568 —-a-w c:\program files\ttaximp.dll
2000-11-07 15:21 7,115 —-a-w c:\program files\ttaxexpt.dat
2000-10-10 16:06 29 —-a-w c:\program files\toolbar.ini
2000-09-19 22:36 51 —-a-w c:\program files\QAppID.ini
2000-09-19 19:36 3,033,651 —-a-w c:\program files\host.exe
2000-05-31 19:20 57,856 —-a-w c:\program files\mrtProc.dll
2000-05-31 19:20 104,448 —-a-w c:\program files\mrbUpd.dll
1999-04-30 21:00 98,304 ——w c:\program files\internet explorer\plugins\UPjpeg.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-02-20_16.20.15.98 )))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MoneyAgent"="c:\program files\Microsoft Money\System\Money Express.exe" [2001-07-25 184376]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"Weather"="c:\progra~1\AWS\WEATHE~1\Weather.exe" [2005-06-07 1339392]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-14 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-10-17 51048]

c:\documents and settings\david childers\Start Menu\Programs\Startup\
PowerReg Scheduler.exe [2002-02-22 256000]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Camio Viewer 2000.lnk - c:\program files\Sierra Imaging\Image Expert 2000\IXApplet.exe [2002-02-14 49152]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]
PowerReg Scheduler.exe [2002-02-22 256000]
RealDownload.lnk - c:\program files\Real\RealDownload\Realdownload.exe [2005-09-07 20516]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{EDB0E980-90BD-11D4-8599-0008C7D3B6F8}"= "c:\progra~1\Qualcomm\Eudora\EuShlExt.dll" [2001-04-12 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.ctmp3"= c:\windows\System32\ctmp3.acm
"aux1"= ctwdm32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=

R2 tcaicchg;tcaicchg;c:\windows\SYSTEM32\TCAICCHG.SYS [2002-02-14 21233]
R2 TCAITDI;TCAITDI Protocol;c:\windows\SYSTEM32\DRIVERS\TCAITDI.SYS [2002-02-14 19534]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2008-12-18 99376]
R3 Msikbd2k;DellTouch;c:\windows\SYSTEM32\DRIVERS\Msikbd2k.sys [2002-02-14 6942]
S2 LiveUpdate Notice;LiveUpdate Notice;c:\program files\Common Files\Symantec Shared\CCSVCHST.EXE [2007-08-25 149352]
S3 COH_Mon;COH_Mon;c:\windows\SYSTEM32\DRIVERS\COH_Mon.sys [2007-05-29 23888]

— Other Services/Drivers In Memory —

*NewlyCreated* - COMHOST
*Deregistered* - Netman
*Deregistered* - Nhksrv
*Deregistered* - Nla
*Deregistered* - NVSvc
*Deregistered* - PolicyAgent
*Deregistered* - ProtectedStorage
*Deregistered* - RasMan
*Deregistered* - RpcSs
*Deregistered* - SamSs
*Deregistered* - Schedule
*Deregistered* - seclogon
*Deregistered* - SENS
*Deregistered* - SharedAccess
*Deregistered* - ShellHWDetection
*Deregistered* - Spooler
*Deregistered* - srservice
*Deregistered* - SSDPSRV
*Deregistered* - stisvc
*Deregistered* - Symantec Core LC
*Deregistered* - TapiSrv
*Deregistered* - TermService
*Deregistered* - Themes
*Deregistered* - TrkWks
*Deregistered* - Viewpoint Manager Service
*Deregistered* - W32Time
*Deregistered* - WebClient
*Deregistered* - winmgmt
*Deregistered* - WMDM PMSP Service
*Deregistered* - wscsvc
*Deregistered* - wuauserv
*Deregistered* - WZCSVC
.
Contents of the 'Scheduled Tasks' folder

2009-02-17 c:\windows\Tasks\Norton Internet Security - Run Full System Scan - david childers.job
- c:\program files\Norton Internet Security\Norton AntiVirus\Navw32.exe [2007-08-26 20:19]
.
.
——- Supplementary Scan ——-
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
Name-Space Handler: ftp\RealDownload - {EBCDDA5E-2A68-11D3-8A43-0060083CFB9C} - c:\windows\SYSTEM32\nzdd.dll
Name-Space Handler: http\RealDownload - {EBCDDA5E-2A68-11D3-8A43-0060083CFB9C} - c:\windows\SYSTEM32\nzdd.dll
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-21 12:54:37
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-1194005503-2805738209-4071888707-1007\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_LOCAL_MACHINE\software\Classes\giffile\shell\Open\ddeexec]
@DACL=(02 0000)
@="\"file:%1\",,-1,,,,,"
.
———————— Other Running Processes ————————
.
c:\progra~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
c:\windows\Nhksrv.exe
c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe
c:\windows\SYSTEM32\CTSVCCDA.EXE
c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\windows\SYSTEM32\nvsvc32.exe
c:\program files\Viewpoint\Common\ViewpointService.exe
c:\windows\SYSTEM32\MsPMSPSv.exe
c:\program files\Viewpoint\Viewpoint Manager\ViewMgr.exe
c:\windows\SYSTEM32\devldr32.exe
.
**************************************************************************
.
Completion time: 2009-02-21 13:00:39 - machine was rebooted
ComboFix-quarantined-files.txt 2009-02-21 18:00:33
ComboFix2.txt 2009-02-20 21:23:03

Pre-Run: 64,661,917,696 bytes free
Post-Run: 64,649,236,480 bytes free

314 — E O F — 2009-02-20 20:36:18
Post #14
here is the hijackthis log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:08:38 PM, on 2/21/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Nhksrv.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\PROGRA~1\AWS\WEATHE~1\Weather.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
C:\Program Files\Symantec\LiveUpdate\AUPDATE.EXE
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Viewpoint Toolbar BHO - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\Program Files\Viewpoint\Viewpoint Toolbar\3.8.0\ViewBarBHO.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: BrowserHelper Class - {EBCDDA60-2A68-11D3-8A43-0060083CFB9C} - C:\WINDOWS\system32\nzdd.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll
O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.8.0\IEViewBar.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Weather] C:\PROGRA~1\AWS\WEATHE~1\Weather.exe 1
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Startup: PowerReg Scheduler.exe
O4 - Global Startup: Camio Viewer 2000.lnk = C:\Program Files\Sierra Imaging\Image Expert 2000\IXApplet.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: PowerReg Scheduler.exe
O4 - Global Startup: RealDownload.lnk = C:\Program Files\Real\RealDownload\Realdownload.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.av.aol.com/molbin/shared/m…83/mcinsctl.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1136785131515
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.av.aol.com/molbin/shared/m…,20/mcgdmgr.cab
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Netropa NHK Server (Nhksrv) - Unknown owner - C:\WINDOWS\Nhksrv.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

–
End of file - 8448 bytes
Post #15
when i ran gmer i scaned then when it was done i hit ok, log never came up? pretty sure i did it right you give very good Instructions. Start > Run > copy/paste msconfig into the runbox > Enter Select - StartUp Tab - Enable all Select - Services Tab - enable all they where all enabled already thanks again

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI