HI OM
OK i changed the name and ran the file …. i have FLOCK so the file name did not change the first 2 times so i moved the file to the trash and finally figured out how to change it in FLOCK ….
I disabled the Windows firewall and looked for AVG …but could not find it … also tried to disable NORTON …but i couldn't see how to do that with what i had coming up … i believe it is only a 'SALES' remnant remaining …. the COMBO-FIX displayed this prompt before it restarted and asked me to WRITE IT DOWN so here are the files listed by COMBO-FIX
C:\WINDOWS\system32\drivers\TDSSpaxt.Sys
" " \ TDSSofxh.dll
" " \ TDSSosvd.dat
" " \TDSSnrsr.dll
" " \TDSSriqp.dll
" " \TDSScfum.dll
" " \TDSSfxwp.dll
" " \TDSStkdv.log
" " \TDSSsbhc.dll
" " \TDSSrhym.log
UPON the restart a DATA EXECUTION PREVENTION Prompt turned up
"Windows has closed this Program"
WMI
Microsoft Corporation
THATS about what happened
HERE IS THE LOG FROM COMBO-FIX
ComboFix 09-03-02.01 - HP_Administrator 2009-03-02 18:24:09.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1982.1546 [GMT -8:00]
Running from: c:\documents and settings\[removed]\Desktop\Combo-Fix.exe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\All Users\Application Data\CrucialSoft Ltd
c:\documents and settings\All Users\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\LOG\20090124111710265.log
c:\documents and settings\All Users\Application Data\Microsoft\Internet Explorer\DLLs\c.cgm
c:\documents and settings\All Users\Application Data\Microsoft\Protect\svhost.exe
c:\documents and settings\All Users\Application Data\Microsoft\Protect\track.sys
c:\program files\Spyware Guard 2008
c:\program files\Spyware Guard 2008\conf.cfg
c:\program files\Spyware Guard 2008\queue.vdb
c:\program files\Spyware Guard 2008\spywareguard.exe
c:\program files\Spyware Guard 2008\uninstall.exe
c:\windows\aazalirt.exe
c:\windows\iddqdops.exe
c:\windows\jikglond.exe
c:\windows\jiklagka.exe
c:\windows\jungertab.exe
c:\windows\klopnidret.exe
c:\windows\reged.exe
c:\windows\ronitfst.exe
c:\windows\salrtybek.exe
c:\windows\seeukluba.exe
c:\windows\skaaanret.exe
c:\windows\spoolsystem.exe
c:\windows\sys.com
c:\windows\syscert.exe
c:\windows\sysguard.exe
c:\windows\system32\a.exe
c:\windows\system32\adiduyag.ini
c:\windows\system32\afevupug.ini
c:\windows\system32\aghdff.dll
c:\windows\system32\agironof.ini
c:\windows\system32\agowefuw.ini
c:\windows\system32\ahabuyug.ini
c:\windows\system32\akehatow.ini
c:\windows\system32\akswir.dll
c:\windows\system32\alanebor.ini
c:\windows\system32\aleyahet.ini
c:\windows\system32\amapohur.ini
c:\windows\system32\anuvahih.ini
c:\windows\system32\apajusuy.ini
c:\windows\system32\apunegiw.ini
c:\windows\system32\argxmq.dll
c:\windows\system32\asiwebap.ini
c:\windows\system32\atezedif.ini
c:\windows\system32\awfrrf.dll
c:\windows\system32\azizowok.ini
c:\windows\system32\azumasin.ini
c:\windows\system32\bajukeko.dll
c:\windows\system32\bewudogi.dll
c:\windows\system32\bfcrjn.dll
c:\windows\system32\bunuzope.dll
c:\windows\system32\buzrat.dll
c:\windows\system32\cmunvb.dll
c:\windows\system32\cmxyic.dll
c:\windows\system32\czhpou.dll
c:\windows\system32\dapipobi.dll
c:\windows\system32\demayoha.dll
c:\windows\system32\dewezuwa.dll
c:\windows\system32\dijekaha.dll
c:\windows\system32\divasalo.dll
c:\windows\system32\doluwuhi.dll
c:\windows\system32\dositesu.dll
c:\windows\system32\drivers\TDSSpaxt.sys
c:\windows\system32\dukakame.dll
c:\windows\system32\dumavuja.dll
c:\windows\system32\edefibuj.ini
c:\windows\system32\edihonay.ini
c:\windows\system32\edojukiy.ini
c:\windows\system32\eduhisiy.ini
c:\windows\system32\efemiviy.ini
c:\windows\system32\egijiroh.ini
c:\windows\system32\elqdjw.dll
c:\windows\system32\emakakud.ini
c:\windows\system32\eotivv.dll
c:\windows\system32\eripijid.ini
c:\windows\system32\erofisup.ini
c:\windows\system32\evijolez.ini
c:\windows\system32\evokerad.ini
c:\windows\system32\ewajemaw.ini
c:\windows\system32\ewuhopah.ini
c:\windows\system32\eyibebuv.ini
c:\windows\system32\ezalujaj.ini
c:\windows\system32\ezomugar.ini
c:\windows\system32\fcsstu.dll
c:\windows\system32\fefiweta.dll
c:\windows\system32\fituzafi.dll
c:\windows\system32\gadibure.dll
c:\windows\system32\gadisiva.dll
c:\windows\system32\gayudida.dll
c:\windows\system32\gebegimi.dll
c:\windows\system32\geleboje.dll
c:\windows\system32\gopigede.dll
c:\windows\system32\gthicl.dll
c:\windows\system32\hapohuwe.dll
c:\windows\system32\hdkied.dll
c:\windows\system32\hefakola.dll
c:\windows\system32\hidisuza.dll
c:\windows\system32\hidujuku.dll
c:\windows\system32\higawaka.dll
c:\windows\system32\hihavuna.dll
c:\windows\system32\hokipofu.dll
c:\windows\system32\howokogu.dll
c:\windows\system32\hulifeki.dll
c:\windows\system32\hxbecv.dll
c:\windows\system32\hztled.dll
c:\windows\system32\ibeyemew.ini
c:\windows\system32\ibitawum.ini
c:\windows\system32\ibopipad.ini
c:\windows\system32\idipemil.ini
c:\windows\system32\iehelper.dll
c:\windows\system32\ifuvejit.ini
c:\windows\system32\igoduweb.ini
c:\windows\system32\ihbqmf.dll
c:\windows\system32\ijipdp.dll
c:\windows\system32\ilusudem.ini
c:\windows\system32\imamagad.ini
c:\windows\system32\iorbkx.dll
c:\windows\system32\ipanolet.ini
c:\windows\system32\ipobayaf.ini
c:\windows\system32\irobabew.ini
c:\windows\system32\isohodiv.ini
c:\windows\system32\itenegow.ini
c:\windows\system32\itihazon.ini
c:\windows\system32\iudfiz.dll
c:\windows\system32\ivujabek.ini
c:\windows\system32\izowehaw.ini
c:\windows\system32\jagepeyu.dll
c:\windows\system32\jajulaze.dll
c:\windows\system32\jamamafo.dll
c:\windows\system32\jamazote.dll
c:\windows\system32\jbngyc.dll
c:\windows\system32\jevujuza.dll
c:\windows\system32\jifetahi.dll
c:\windows\system32\jisopisi.dll
c:\windows\system32\jogejopi.dll
c:\windows\system32\jqygga.dll
c:\windows\system32\juvokose.dll
c:\windows\system32\kahowuhi.dll
c:\windows\system32\kamileva.dll
c:\windows\system32\kanhzh.dll
c:\windows\system32\kasiyebo.dll
c:\windows\system32\kcxiok.dll
c:\windows\system32\kebajuvi.dll
c:\windows\system32\kebikagu.dll
c:\windows\system32\kewowupa.dll
c:\windows\system32\khuoxt.dll
c:\windows\system32\kiganopo.dll
c:\windows\system32\kivumolo.dll
c:\windows\system32\kowoziza.dll
c:\windows\system32\kubiwipi.dll
c:\windows\system32\kupirire.dll
c:\windows\system32\kzdwee.dll
c:\windows\system32\lasefoye.dll
c:\windows\system32\lccdvg.dll
c:\windows\system32\lenisako.dll
c:\windows\system32\libodiwa.dll
c:\windows\system32\ligijupu.dll
c:\windows\system32\lijaduhi.dll
c:\windows\system32\limepidi.dll
c:\windows\system32\lkoeod.dll
c:\windows\system32\lomokafu.dll
c:\windows\system32\ludiyofu.dll
c:\windows\system32\lufesoko.dll
c:\windows\system32\luwtvv.dll
c:\windows\system32\lxdynh.dll
c:\windows\system32\magiduko.dll
c:\windows\system32\mamotapi.dll
c:\windows\system32\mapenelo.dll
c:\windows\system32\mawijeho.dll
c:\windows\system32\meacvn.dll
c:\windows\system32\mezeweku.dll
c:\windows\system32\mibewoja.dll
c:\windows\system32\mitapimu.dll
c:\windows\system32\miziwiva.dll
c:\windows\system32\mnmuno.dll
c:\windows\system32\modabura.dll
c:\windows\system32\mohafilu.dll
c:\windows\system32\muwatibi.dll
c:\windows\system32\natulevo.dll
c:\windows\system32\nazofafo.dll
c:\windows\system32\nhnhtr.dll
c:\windows\system32\niejex.dll
c:\windows\system32\nifisofo.dll
c:\windows\system32\nobawitu.dll
c:\windows\system32\nojuvuva.dll
c:\windows\system32\norobeta.dll
c:\windows\system32\nozahiti.dll
c:\windows\system32\nukizani.dll
c:\windows\system32\nupikufo.dll
c:\windows\system32\nusoyeta.dll
c:\windows\system32\nuyakete.dll
c:\windows\system32\nxrepf.dll
c:\windows\system32\obeyisak.ini
c:\windows\system32\obkgse.dll
c:\windows\system32\odavizos.ini
c:\windows\system32\odekikag.ini
c:\windows\system32\ofczam.dll
c:\windows\system32\ofukipun.ini
c:\windows\system32\ogelapiw.ini
c:\windows\system32\ogunefat.ini
c:\windows\system32\ojipowav.ini
c:\windows\system32\okasinel.ini
c:\windows\system32\okekujab.ini
c:\windows\system32\olomuvik.ini
c:\windows\system32\omutovis.ini
c:\windows\system32\orinarep.ini
c:\windows\system32\orunitag.ini
c:\windows\system32\osopazov.ini
c:\windows\system32\otusidoh.ini
c:\windows\system32\ouwfly.dll
c:\windows\system32\pawasonu.dll
c:\windows\system32\peraniro.dll
c:\windows\system32\pisiluvu.dll
c:\windows\system32\pusifore.dll
c:\windows\system32\qagvfc.dll
c:\windows\system32\qgofof.dll
c:\windows\system32\qnyrrq.dll
c:\windows\system32\qoeedn.dll
c:\windows\system32\qvigdz.dll
c:\windows\system32\raditile.dll
c:\windows\system32\ragumoze.dll
c:\windows\system32\rayedutu.dll
c:\windows\system32\rhleud.dll
c:\windows\system32\robenala.dll
c:\windows\system32\robuteza.dll
c:\windows\system32\rogiwunu.dll
c:\windows\system32\rtufso.dll
c:\windows\system32\ruyutego.dll
c:\windows\system32\sabafiru.dll
c:\windows\system32\semasema.dll
c:\windows\system32\sesotoja.dll
c:\windows\system32\sikizela.dll
c:\windows\system32\sivotumo.dll
c:\windows\system32\slnrvg.dll
c:\windows\system32\sozivado.dll
c:\windows\system32\suamnd.dll
c:\windows\system32\suluyeba.dll
c:\windows\system32\sxctkc.dll
c:\windows\system32\tafenugo.dll
c:\windows\system32\tateputu.dll
c:\windows\system32\tazobogi.dll
c:\windows\system32\TDSScfum.dll
c:\windows\system32\TDSSfxwp.dll
c:\windows\system32\TDSSnmxh.log
c:\windows\system32\TDSSnrsr.dll
c:\windows\system32\TDSSofxh.dll
c:\windows\system32\TDSSosvd.dat
c:\windows\system32\TDSSrhym.log
c:\windows\system32\TDSSriqp.dll
c:\windows\system32\TDSSsbhc.dll
c:\windows\system32\TDSStkdv.log
c:\windows\system32\tegavipo.dll
c:\windows\system32\tenolabo.dll
c:\windows\system32\tidadegi.dll
c:\windows\system32\tijevufi.dll
c:\windows\system32\tizuluke.dll
c:\windows\system32\toraheke.dll
c:\windows\system32\tvheku.dll
c:\windows\system32\twlovv.dll
c:\windows\system32\uamynt.dll
c:\windows\system32\udokalul.ini
c:\windows\system32\ukujudih.ini
c:\windows\system32\umegizul.ini
c:\windows\system32\unosawap.ini
c:\windows\system32\upedidub.ini
c:\windows\system32\vajetezo.dll
c:\windows\system32\vavusani.dll
c:\windows\system32\vawopijo.dll
c:\windows\system32\vcmuao.dll
c:\windows\system32\velefusi.dll
c:\windows\system32\vinomisu.dll
c:\windows\system32\vnquig.dll
c:\windows\system32\vomuganu.dll
c:\windows\system32\vozaposo.dll
c:\windows\system32\vuboduje.dll
c:\windows\system32\vufurajo.dll
c:\windows\system32\vzchwy.dll
c:\windows\system32\wakatuha.dll
c:\windows\system32\wcibow.dll
c:\windows\system32\wctymg.dll
c:\windows\system32\wemeyebi.dll
c:\windows\system32\wfwindowp32.dll
c:\windows\system32\wigudozi.dll
c:\windows\system32\winscenter.exe
c:\windows\system32\wipalego.dll
c:\windows\system32\wogeneti.dll
c:\windows\system32\wufewoga.dll
c:\windows\system32\wuleluzu.dll
c:\windows\system32\xccefy.dll
c:\windows\system32\xxuxsm.dll
c:\windows\system32\xyyivm.dll
c:\windows\system32\yijazowi.dll
c:\windows\system32\yikujode.dll
c:\windows\system32\yinuyoni.dll
c:\windows\system32\yisihude.dll
c:\windows\system32\yozakapa.dll
c:\windows\system32\yvqewa.dll
c:\windows\system32\ywlnha.dll
c:\windows\system32\zakupuju.dll
c:\windows\system32\zehejevo.dll
c:\windows\system32\zelojive.dll
c:\windows\system32\ziyiwori.dll
c:\windows\system32\zizwpz.dll
c:\windows\system32\zjdwaf.dll
c:\windows\system32\zkyyko.dll
c:\windows\system32\zqhpnc.dll
c:\windows\system32\zugowuva.dll
c:\windows\system32\zxxtit.dll
c:\windows\Tasks\whqznqrt.job
c:\windows\tobmygers.exe
c:\windows\tobykke.exe
c:\windows\vmreg.dll
c:\windows\zibaglertz.exe
D:\Autorun.inf
D:\install.exe
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
——-\Service_TDSSserv.sys
——-\Legacy_TDSSserv.sys
((((((((((((((((((((((((( Files Created from 2009-02-03 to 2009-03-03 )))))))))))))))))))))))))))))))
.
2009-03-02 11:18 . 2009-03-02 11:18 d——– c:\program files\Prevx
2009-03-02 11:18 . 2009-03-02 11:19 d——– c:\documents and settings\All Users\Application Data\PrevxCSI
2009-03-02 11:18 . 2009-03-02 11:18 22,536 –a—— c:\windows\system32\drivers\pxscan.sys
2009-03-01 18:51 . 2009-03-01 18:51 d——– c:\program files\Trend Micro
2009-03-01 15:25 . 2009-03-01 15:25 d——– c:\program files\ERUNT
2009-02-28 16:00 . 2009-02-28 16:02 d–h—– C:\$AVG8.VAULT$
2009-02-28 15:44 . 2009-02-28 17:00 d——– c:\documents and settings\All Users\Application Data\avg8
2009-02-27 01:29 . 2009-02-27 01:29 d——– c:\documents and settings\HP_Administrator\Application Data\NCH Swift Sound
2009-02-27 01:28 . 2009-02-27 01:28 d——– c:\program files\NCH Swift Sound
2009-02-27 01:28 . 2009-02-27 01:28 d——– c:\documents and settings\All Users\Application Data\NCH Swift Sound
2009-02-27 01:04 . 2009-02-27 01:04 d——– c:\program files\Panda Security
2009-02-26 22:57 . 2009-02-28 16:58 d——– c:\program files\Spybot - Search & Destroy
2009-02-26 22:57 . 2009-02-28 16:58 d——– c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-02-26 21:36 . 2009-02-26 21:37 d——– c:\documents and settings\HP_Administrator\.housecall6.6
2009-02-26 21:36 . 2009-02-26 21:36 102,664 –a—— c:\windows\system32\drivers\tmcomm.sys
2009-02-25 22:50 . 2009-02-26 11:50 d——– C:\MyAudio
2009-02-25 22:49 . 2009-02-25 23:10 d——– c:\program files\AoA Audio Extractor
2009-02-19 02:14 . 2009-02-19 02:14 d——– c:\documents and settings\All Users\Application Data\PC Tools
2009-02-19 02:14 . 2009-02-02 14:04 12,560 –a—— c:\windows\system32\drivers\TfKbMon.sys
2009-02-16 01:18 . 2009-02-16 01:18 d——– C:\TubeTilla Free
2009-02-16 01:01 . 2009-02-16 01:01 d——– c:\documents and settings\HP_Administrator\Application Data\Media Player Classic
2009-02-16 01:00 . 2009-02-16 01:57 d——– C:\CoolOutput
2009-02-16 00:59 . 2009-02-26 21:57 d——– c:\program files\Cool Free All Video to Mp4 MPEG Converter
2009-02-16 00:59 . 2009-02-16 00:59 34 –ah—– c:\windows\system32\Converter_sysquict.dat
2009-02-16 00:57 . 2009-02-16 00:57 d——– c:\program files\K-Lite Codec Pack
2009-02-16 00:57 . 2008-07-03 22:34 860,160 –a—— c:\windows\system32\lameACM.acm
2009-02-16 00:57 . 2009-02-16 00:57 823,296 –a—— c:\windows\is-NNSGC.exe
2009-02-16 00:57 . 2007-09-04 08:56 164,352 –a—— c:\windows\system32\unrar.dll
2009-02-16 00:57 . 2007-09-20 16:52 118,784 –a—— c:\windows\system32\is-USQHP.tmp
2009-02-16 00:57 . 2009-02-16 00:57 10,665 –a—— c:\windows\is-NNSGC.msg
2009-02-16 00:57 . 2009-02-16 00:57 1,773 –a—— c:\windows\is-NNSGC.lst
2009-02-16 00:57 . 2007-10-03 07:03 414 –a—— c:\windows\system32\lame_acm.xml
2009-02-15 19:03 . 2004-09-07 11:42 86,085 –a—— c:\windows\system32\ImageDrive.cpl
2009-02-12 19:58 . 2009-02-28 17:05 d——– c:\program files\SpywareGuard
2009-02-12 19:55 . 2009-02-26 21:56 d——– c:\program files\SpywareBlaster
2009-02-12 01:32 . 2009-02-12 01:32 d——– c:\documents and settings\Guest\Application Data\Flock
2009-02-10 18:59 . 2009-02-10 18:59 d——– c:\documents and settings\All Users\Application Data\Pinnacle VideoSpin
2009-02-10 18:57 . 2009-02-10 18:57 d——– c:\documents and settings\All Users\Application Data\VideoSpin
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-03 02:08 ——— d—–w c:\program files\Norton Security Scan
2009-03-03 01:37 ——— d—–w c:\program files\Flock
2009-03-02 08:19 ——— d—a-w c:\documents and settings\All Users\Application Data\TEMP
2009-03-02 02:15 ——— d—–w c:\documents and settings\All Users\Application Data\Google Updater
2009-03-01 01:17 ——— d—–w c:\program files\Sun
2009-03-01 00:59 ——— d—–w c:\program files\WildTangent
2009-02-27 05:46 ——— d—–w c:\program files\Common Files\Symantec Shared
2009-02-27 05:46 ——— d—–w c:\documents and settings\All Users\Application Data\Symantec
2009-02-27 05:45 ——— d—–w c:\program files\Symantec
2009-02-27 05:45 ——— d—–w c:\program files\Norton 360
2009-02-26 10:05 ——— d—–w c:\program files\Click'N Design 3D (V5)
2009-02-26 09:03 ——— d—–w c:\program files\Piolet
2009-02-19 10:46 ——— d—–w c:\program files\Malwarebytes' Anti-Malware
2009-02-16 19:29 193,640 —-a-w c:\documents and settings\HP_Administrator\Application Data\GDIPFONTCACHEV1.DAT
2009-02-13 22:42 ——— d—–w c:\documents and settings\HP_Administrator\Application Data\muvee Technologies
2009-02-11 04:39 ——— d—–w c:\program files\AviSynth 2.5
2009-02-11 02:57 ——— d—–w c:\program files\Pinnacle
2009-02-07 22:08 ——— d—–w c:\program files\SecondLife
2009-02-02 21:05 ——— d—–w c:\program files\Roxio
2009-02-02 20:12 ——— d—–w c:\program files\DivX
2009-01-24 19:40 ——— d—–w c:\program files\MalwareRemovalBot
2009-01-24 19:35 ——— d—–w c:\documents and settings\HP_Administrator\Application Data\MalwareRemovalBot
2009-01-22 03:49 864 –sha-w C:\3whjawja.sys
2009-01-13 01:56 ——— d—–w c:\program files\FXhome CompositeLab Pro
2009-01-11 23:08 ——— d—–w c:\documents and settings\HP_Administrator\Application Data\MSNInstaller
2009-01-11 22:36 ——— d—–w c:\documents and settings\HP_Administrator\Application Data\Flock
2009-01-10 04:07 ——— d—–w c:\program files\AdorageI-SAL
2008-10-06 01:33 170 —-a-w c:\documents and settings\HP_Administrator\Application Data\wklnhst.dat
2007-08-31 09:08 135,680 —-a-w c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
2006-05-03 10:06 163,328 –sha-r c:\windows\system32\flvDX.dll
2007-02-21 11:47 31,744 –sha-r c:\windows\system32\msfDX.dll
2007-03-02 03:31 32,768 –sha-w c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"rundll32.exe"="c:\documents and settings\HP_Administrator\Application Data\Macromedia\Common\9e0840921.dll" [2009-02-25 64512]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UserFaultCheck"="c:\windows\system32\dumprep 0 -u" [X]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-05-09 7311360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"rundll32.exe"="c:\documents and settings\NetworkService\Application Data\Macromedia\Common\9e0840921.dll" [2009-02-25 64512]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2004-08-09 c:\windows\system32\narrator.exe]
c:\documents and settings\Guest\Start Menu\Programs\Startup\
PinMcLnk.lnk - c:\hp\bin\cloaker.exe [2006-08-18 27136]
c:\documents and settings\HPLAPTOP\Start Menu\Programs\Startup\
PinMcLnk.lnk - c:\hp\bin\cloaker.exe [2006-08-18 27136]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"wave1"= c:\docume~1\HP_ADM~1\APPLIC~1\MACROM~1\Common\9e0840921.dll
"midi1"= c:\docume~1\HP_ADM~1\APPLIC~1\MACROM~1\Common\9e0840921.dll
"mixer1"= c:\docume~1\HP_ADM~1\APPLIC~1\MACROM~1\Common\9e0840921.dll
"aux1"= c:\docume~1\HP_ADM~1\APPLIC~1\MACROM~1\Common\9e0840921.dll
"wave2"= c:\docume~1\HP_ADM~1\APPLIC~1\MACROM~1\Common\9e0840921.dll
"midi2"= c:\docume~1\HP_ADM~1\APPLIC~1\MACROM~1\Common\9e0840921.dll
"mixer2"= c:\docume~1\HP_ADM~1\APPLIC~1\MACROM~1\Common\9e0840921.dll
"aux2"= c:\docume~1\HP_ADM~1\APPLIC~1\MACROM~1\Common\9e0840921.dll
"VIDC.PIM1"= pclepim1.dll
"VIDC.I420"= i420vfw.dll
"VIDC.MJPG"= pvmjpg21.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ cli
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Updates from HP\\9972322\\Program\\Updates from HP.exe"=
"c:\\Program Files\\Piolet\\Piolet.exe"=
"c:\\Program Files\\Azureus\\Azureus.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\vt3studio\\vt3mws\\VT3MWS.EXE"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\WINDOWS\\system32\\fxsclnt.exe"=
"c:\\Documents and Settings\\HP_Administrator\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.dll"=
"c:\\Documents and Settings\\HP_Administrator\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Program Files\\Common Files\\Symantec Shared\\CCPD-LC\\symlcsvc.exe"=
"c:\\WINDOWS\\system32\\spoolsv.exe"=
"c:\\WINDOWS\\ehome\\ehrecvr.exe"=
"c:\\Program Files\\Google\\Common\\Google Updater\\GoogleUpdaterService.exe"=
"c:\\WINDOWS\\system32\\dllhost.exe"=
"c:\\WINDOWS\\system32\\dwwin.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
R0 pxscan;pxscan;c:\windows\system32\drivers\pxscan.sys [2009-03-02 22536]
R2 CSIScanner;CSIScanner;c:\program files\Prevx\prevx.exe [2009-03-02 4150840]
R2 MSSQL$RETSDATA;MSSQL$RETSDATA;c:\program files\Microsoft SQL Server\MSSQL$RETSDATA\Binn\sqlservr.exe -sRETSDATA –> c:\program files\Microsoft SQL Server\MSSQL$RETSDATA\Binn\sqlservr.exe -sRETSDATA [?]
S0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys –> c:\windows\system32\drivers\TfFsMon.sys [?]
S0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys –> c:\windows\system32\drivers\TfSysMon.sys [?]
S2 RoxLiveShare10;LiveShare P2P Server 10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe [2007-08-24 309744]
S2 RoxWatch10;Roxio Hard Drive Watcher 10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatch10.exe [2007-08-24 166384]
S3 SQLAgent$RETSDATA;SQLAgent$RETSDATA;c:\program files\Microsoft SQL Server\MSSQL$RETSDATA\Binn\sqlagent.EXE -i RETSDATA –> c:\program files\Microsoft SQL Server\MSSQL$RETSDATA\Binn\sqlagent.EXE -i RETSDATA [?]
S3 TfNetMon;TfNetMon;\??\c:\windows\system32\drivers\TfNetMon.sys –> c:\windows\system32\drivers\TfNetMon.sys [?]
S4 Roxio UPnP Renderer 10;Roxio UPnP Renderer 10;c:\program files\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe [2007-08-24 72176]
S4 Roxio Upnp Server 10;Roxio Upnp Server 10;c:\program files\Roxio\Digital Home 10\RoxioUpnpService10.exe [2007-08-24 362992]
S4 RoxMediaDB10;RoxMediaDB10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe [2007-08-24 1083888]
S4 SessionLauncher;SessionLauncher;c:\docume~1\HP_ADM~1\LOCALS~1\Temp\DX9\SessionLauncher.exe –> c:\docume~1\HP_ADM~1\LOCALS~1\Temp\DX9\SessionLauncher.exe [?]
S4 ThreatFire;ThreatFire;c:\program files\ThreatFire\TFService.exe service –> c:\program files\ThreatFire\TFService.exe service [?]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{575046a8-3b27-11dd-a840-0018f3308545}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL autorun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cbc8f6e4-b328-11dc-a81f-0018f3308545}]
\Shell\AutoRun\command - M:\setupSNK.exe
.
Contents of the 'Scheduled Tasks' folder
2009-03-02 c:\windows\Tasks\Backup.job
- c:\windows\system32\ntbackup.exe [2004-08-09 20:00]
2009-03-03 c:\windows\Tasks\Disk Cleanup.job
- c:\windows\system32\cleanmgr.exe [2004-08-09 20:00]
2009-03-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2769080022-1748412195-781348209-1007.job
- c:\documents and settings\HP_Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-02 19:02]
2009-03-02 c:\windows\Tasks\MalwareRemovalBot Scheduled Scan.job
- c:\program files\MalwareRemovalBot\MalwareRemovalBot.exe []
2009-03-02 c:\windows\Tasks\MalwareRemovalBot Scheduled Scan.job
- c:\program files\MalwareRemovalBot [2009-01-24 11:40]
2009-03-02 c:\windows\Tasks\Norton 360.job
- c:\progra~1\NORTON~2\MainStub.exe []
2009-03-02 c:\windows\Tasks\Norton Security Scan for HP_Administrator.job
- c:\program files\Norton Security Scan\Nss.exe [2008-09-19 04:18]
2009-02-20 c:\windows\Tasks\Rescue Reminder for 2HAPX1GZ.job
- c:\program files\Maxtor\ManagerApp\MaxUtilities.exe [2008-07-21 16:52]
2009-03-02 c:\windows\Tasks\User_Feed_Synchronization-{17F015C8-57FA-45D9-B2E3-851F92A5E8AA}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 11:58]
.
- - - - ORPHANS REMOVED - - - -
WebBrowser-{C75C8E7E-5059-4469-AC11-D7544B260382} - c:\program files\Piolet Toolbar\v3.0.0.0\Piolet_Toolbar.dll
WebBrowser-{74CC49F7-EB32-4A08-B204-948962A6E3DB} - (no file)
HKLM-Run-PCDrProfiler - (no file)
SharedTaskScheduler-{EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\sikizela.dll
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uDefault_Search_URL = hxxp://www.google.com/ie
mStart Page = about:blank
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2009-03-02 18:32:19
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{399560AD-16A1-1C42-B8ABCDA82BB95BD1}\{612A140D-0F00-4178-3873E27B58551793}\{AE627BFA-B567-4F9A-57DD34442A0D5150}*]
"S6KI1YERXJTIP3T5RVDI41UR2G1"=hex:01,00,01,00,00,00,00,00,26,ff,b1,c2,08,0b,50,
9e,35,81,92,71,e8,29,5a,84,14,35,16,70,d8,6e,ff,61
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"cd042efbbd7f7af1647644e76e06692b"=hex:e2,63,26,f1,3f,c8,ff,68,fc,ef,e8,e9,7c,
ff,43,27,e2,63,26,f1,3f,c8,ff,68,fb,33,8c,4a,9e,64,42,81,e2,63,26,f1,3f,c8,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"bca643cdc5c2726b20d2ecedcc62c59b"=hex:71,3b,04,66,8b,46,0d,96,12,86,46,05,e6,
38,11,ea,6a,9c,d6,61,af,45,84,18,45,18,ae,a1,d8,39,24,d2,6a,9c,d6,61,af,45,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2c81e34222e8052573023a60d06dd016"=hex:ff,7c,85,e0,43,d4,0e,fe,35,86,2b,34,64,
4a,c2,2e,ff,7c,85,e0,43,d4,0e,fe,db,ee,69,9c,4c,9e,de,7d,ff,7c,85,e0,43,d4,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2582ae41fb52324423be06337561aa48"=hex:6b,65,49,6a,7e,99,74,f7,40,d3,67,de,f0,
f1,a8,13,86,8c,21,01,be,91,eb,e7,76,7e,8c,b6,be,b0,b2,cc,86,8c,21,01,be,91,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"caaeda5fd7a9ed7697d9686d4b818472"=hex:cd,44,cd,b9,a6,33,6c,cd,35,02,df,b7,65,
04,57,cd,f5,1d,4d,73,a8,13,5c,05,cd,9b,c2,5c,1b,39,eb,0c,f5,1d,4d,73,a8,13,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:b0,18,ed,a7,3f,8d,37,a4,1e,07,a0,03,90,
cd,ff,74,df,20,58,62,78,6b,cf,c8,29,c2,31,07,a1,43,51,73,df,20,58,62,78,6b,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"4d370831d2c43cd13623e232fed27b7b"=hex:fb,a7,78,e6,12,2f,9a,ea,e3,7a,80,db,bb,
25,3c,88,fb,a7,78,e6,12,2f,9a,ea,74,c0,dd,e3,a7,67,2d,7a,fb,a7,78,e6,12,2f,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1d68fe701cdea33e477eb204b76f993d"=hex:83,6c,56,8b,a0,85,96,ab,04,2a,84,28,a2,
00,7c,04,01,3a,48,fc,e8,04,4a,f1,0d,25,ec,95,21,64,ad,fa,01,3a,48,fc,e8,04,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:f6,0f,4e,58,98,5b,89,c9,1c,c0,ba,99,3e,
4b,c2,8b,f6,0f,4e,58,98,5b,89,c9,e3,88,43,0c,f8,7e,eb,7f,f6,0f,4e,58,98,5b,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EA0A4278-51A3-7709-84DDEF02950ADF94}\{11936336-4B9A-79DD-A94F2AD208D83E94}\{0A7B61F5-80AE-3EB6-867F93DE000E0517}*]
"S6KI1YERXJTIP3T5RVDI41UR2G1"=hex:01,00,01,00,00,00,00,00,26,ff,b1,c2,08,0b,50,
9e,35,81,92,71,e8,29,5a,84,14,35,16,70,d8,6e,ff,61
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"f5f62a6129303efb32fbe080bb27835b"=hex:3d,ce,ea,26,2d,45,aa,78,98,33,8a,df,25,
0d,ee,b0,3d,ce,ea,26,2d,45,aa,78,58,61,28,d9,e7,af,91,d2,3d,ce,ea,26,2d,45,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:e3,0e,66,d5,eb,bc,2f,6b,4a,e8,8c,a7,ad,
03,d8,eb,2a,b7,cc,b5,b9,7f,41,e7,fb,44,43,05,dc,54,7f,19,2a,b7,cc,b5,b9,7f,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"8a8aec57dd6508a385616fbc86791ec2"=hex:6c,43,2d,1e,aa,22,2f,9c,91,f6,16,78,56,
1e,b8,d0,6c,43,2d,1e,aa,22,2f,9c,36,2e,2f,93,ff,71,0b,5a,6c,43,2d,1e,aa,22,\
.
———————— Other Running Processes ————————
.
c:\windows\arservice.exe
c:\windows\ehome\ehrecvr.exe
c:\windows\ehome\ehSched.exe
c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Maxtor\Sync\SyncServices.exe
c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\program files\Microsoft SQL Server\MSSQL$RETSDATA\Binn\sqlservr.exe
c:\windows\system32\nvsvc32.exe
c:\windows\ehome\mcrdsvc.exe
c:\windows\system32\dllhost.exe
c:\windows\system32\dumprep.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\rundll32.exe
.
**************************************************************************
.
Completion time: 2009-03-02 18:37:51 - machine was rebooted
ComboFix-quarantined-files.txt 2009-03-03 02:36:34
Pre-Run: 179,478,622,208 bytes free
615 — E O F — 2007-08-31 10:00:49
HERE IS THE LOG FROM THE HIJACK THIS RERUN RIGHT AFTER
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:47:56 PM, on 3/2/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\arservice.exe
C:\Program Files\Prevx\prevx.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Maxtor\Sync\SyncServices.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Microsoft SQL Server\MSSQL$RETSDATA\Binn\sqlservr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Prevx\prevx.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Flock\flock.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKCU\..\Run: [rundll32.exe] rundll32.exe "C:\Documents and Settings\HP_Administrator\Application Data\Macromedia\Common\9e0840921.dll""
O4 - HKUS\S-1-5-18\..\Run: [rundll32.exe] rundll32.exe "C:\Documents and Settings\LocalService\Application Data\Macromedia\Common\9e0840921.dll"" (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [rundll32.exe] rundll32.exe "C:\Documents and Settings\LocalService\Application Data\Macromedia\Common\9e0840921.dll"" (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - .DEFAULT User Startup: PinMcLnk.lnk = C:\hp\bin\cloaker.exe (User 'Default user')
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: CSIScanner - Prevx - C:\Program Files\Prevx\prevx.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Maxtor Service (Maxtor Sync Service) - Seagate Technology LLC - C:\Program Files\Maxtor\Sync\SyncServices.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: LiveShare P2P Server 10 (RoxLiveShare10) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe
O23 - Service: Roxio Hard Drive Watcher 10 (RoxWatch10) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatch10.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O24 - Desktop Component 0: (no name) - file:///C:/DOCUME~1/HP_ADM~1/LOCALS~1/Temp/msohtml1/01/clip_image005.jpg
O24 - Desktop Component 1: (no name) - file:///C:/DOCUME~1/HP_ADM~1/LOCALS~1/Temp/msohtml1/01/clip_image002.jpg
O24 - Desktop Component 2: (no name) - file:///C:/DOCUME~1/HP_ADM~1/LOCALS~1/Temp/msohtml1/01/clip_image001.jpg
–
End of file - 4706 bytes