[Resolved] Windows Only Runs in Safe Mode; Anti-Malware Apps Inac

ComboFix 09-06-18.02 - Dan 06/20/2009 0:38.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1023.532 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\Dan\Desktop\CFScript.txt
AV: Norton AntiVirus *On-access scanning disabled* (Outdated) {B5510F6F-87E1-47F7-A411-360BC453007C}
FW: Norton Internet Security *disabled* {E641AC2D-955F-4A05-ABE7-F9C534ABDB46}
* Created a new restore point
.
- REDUCED FUNCTIONALITY MODE -

FILE ::
"c:\documents and settings\George\Desktop\movie.233.exe"
"c:\documents and settings\George\Desktop\setup.exe"
"c:\documents and settings\George\Local Settings\Application Data\Mozilla\Firefox\Profiles\h25zejch.default\Cache(3)\56C5C188d01"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\George\Desktop\movie.233.exe
c:\documents and settings\George\Desktop\setup.exe
c:\documents and settings\George\Local Settings\Application Data\Mozilla\Firefox\Profiles\h25zejch.default\Cache(3)\56C5C188d01

.
((((((((((((((((((((((((( Files Created from 2009-05-20 to 2009-06-20 )))))))))))))))))))))))))))))))
.

2009-06-19 21:38 . 2009-06-19 21:38 3561743 —-a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-06-18 03:44 . 2009-06-18 03:44 ——– d—–w- c:\documents and settings\Dan\Local Settings\Application Data\Apple
2009-06-15 13:28 . 2009-06-15 13:28 ——– d—–w- c:\documents and settings\All Users\Application Data\Azureus
2009-06-15 13:28 . 2009-06-15 13:44 ——– d—–w- c:\documents and settings\Andrew\Application Data\Azureus
2009-06-15 13:27 . 2009-06-15 13:28 ——– d—–w- c:\program files\Vuze
2009-06-14 21:15 . 2009-06-14 21:15 ——– d—–w- c:\program files\CCleaner
2009-06-14 19:51 . 2009-06-14 19:51 ——– d—–w- c:\documents and settings\Dan\Application Data\Malwarebytes
2009-06-14 19:51 . 2009-06-17 15:27 38160 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-14 19:51 . 2009-06-19 21:38 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-06-14 19:51 . 2009-06-17 15:27 19096 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-06-14 19:51 . 2009-06-14 19:51 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-06-14 18:01 . 2009-06-19 05:09 117760 —-a-w- c:\documents and settings\Dan\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-06-14 17:10 . 2009-06-14 17:10 ——– d—–w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-06-14 17:10 . 2009-06-14 17:10 ——– d—–w- c:\program files\SUPERAntiSpyware
2009-06-14 17:10 . 2009-06-14 17:10 ——– d—–w- c:\documents and settings\Dan\Application Data\SUPERAntiSpyware.com
2009-06-14 17:09 . 2009-06-14 17:09 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2009-06-14 15:51 . 2009-06-14 15:52 ——– d—–w- c:\documents and settings\Dan\Application Data\QQ Games Plugin
2009-06-14 12:51 . 2009-06-14 12:51 ——– d—–w- c:\documents and settings\Andrew\Application Data\QQ Games Plugin
2009-06-14 12:42 . 2009-06-14 12:42 ——– d—–w- c:\documents and settings\Andrew\Application Data\Yahoo!
2009-06-14 00:35 . 2009-06-14 00:35 ——– d—–w- c:\documents and settings\Lindsay\Application Data\QQ Games Plugin
2009-06-13 21:21 . 2009-06-13 21:21 ——– d—–w- c:\windows\system32\config\systemprofile\Application Data\Yahoo!
2009-06-13 21:08 . 2009-06-14 19:42 ——– d—–w- c:\documents and settings\All Users\Application Data\98178276
2009-06-13 17:47 . 2009-06-13 17:47 ——– d—–w- c:\program files\Tencent
2009-06-13 17:47 . 2009-06-13 17:47 ——– d—–w- c:\documents and settings\All Users\Application Data\Tencent
2009-06-11 11:08 . 2009-06-11 11:08 50320 —-a-w- c:\documents and settings\Guest\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-04 19:41 . 2009-06-04 19:41 56 —ha-w- c:\windows\system32\ezsidmv.dat
2009-06-04 19:40 . 2009-06-18 19:27 ——– d—–w- c:\documents and settings\Lindsay\Application Data\skypePM
2009-06-04 19:39 . 2009-06-18 19:28 ——– d—–w- c:\documents and settings\Lindsay\Application Data\Skype
2009-06-04 19:39 . 2009-06-04 19:39 ——– d—–w- c:\program files\Common Files\Skype
2009-06-04 19:39 . 2009-06-04 19:39 ——– d—–r- c:\program files\Skype
2009-06-04 19:38 . 2009-06-04 19:39 ——– d—–w- c:\documents and settings\All Users\Application Data\Skype
2009-06-04 16:31 . 2009-06-04 16:31 ——– d—–w- c:\documents and settings\Dan\Application Data\acccore
2009-06-04 16:31 . 2009-06-04 16:31 ——– d—–w- c:\documents and settings\Dan\Local Settings\Application Data\AOL OCP
2009-06-04 16:31 . 2009-06-04 16:31 ——– d—–w- c:\documents and settings\Dan\Local Settings\Application Data\AOL
2009-05-31 03:54 . 2009-05-31 03:54 ——– d—–w- c:\program files\HyCam2
2009-05-30 22:37 . 2009-05-30 22:37 ——– d—–w- c:\program files\Microsoft Kids
2009-05-25 00:13 . 2009-05-25 00:13 ——– d–h–w- c:\windows\PIF

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-20 03:45 . 2007-12-13 22:57 288 —-a-w- c:\windows\system32\DVCStateBkp-{00000003-00000000-0000000A-00001102-00000004-00541102}.dat
2009-06-20 03:45 . 2007-12-13 22:57 288 —-a-w- c:\windows\system32\DVCState-{00000003-00000000-0000000A-00001102-00000004-00541102}.dat
2009-06-19 16:15 . 2007-12-13 23:08 ——– d—–w- c:\program files\Common Files\Symantec Shared
2009-06-18 22:29 . 2007-12-17 20:04 50320 —-a-w- c:\documents and settings\Dan\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-18 15:21 . 2007-12-13 23:08 ——– d—–w- c:\program files\Norton AntiVirus
2009-06-16 22:47 . 2008-06-06 22:01 ——– d—–w- c:\documents and settings\Lindsay\Application Data\OpenOffice.org2
2009-06-16 21:43 . 2008-10-04 18:20 1 —-a-w- c:\documents and settings\Lindsay\Application Data\OpenOffice.org2\user\uno_packages\cache\stamp.sys
2009-06-15 13:45 . 2009-05-11 21:36 ——– d—–w- c:\documents and settings\Lindsay\Application Data\uTorrent
2009-06-15 12:36 . 2008-01-09 11:39 1 —-a-w- c:\documents and settings\Andrew\Application Data\OpenOffice.org2\user\uno_packages\cache\stamp.sys
2009-06-15 12:08 . 2008-01-09 11:38 ——– d—–w- c:\documents and settings\Andrew\Application Data\OpenOffice.org2
2009-06-14 15:51 . 2009-03-31 03:11 ——– d—–w- c:\program files\Spybot - Search & Destroy
2009-06-14 00:36 . 2008-02-17 02:00 ——– d—–w- c:\program files\AIMTunes
2009-06-14 00:32 . 2009-03-31 03:11 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-06-14 00:31 . 2007-12-14 02:32 ——– d—–w- c:\program files\AIM6
2009-06-13 17:47 . 2008-02-17 02:00 5946704 —-a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\aimqqgames\QQSetup65.exe
2009-06-13 17:46 . 2008-02-17 02:00 1144808 —-a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\aimtunes\AIMTunes.exe
2009-06-13 17:45 . 2007-12-14 02:33 ——– d—–w- c:\documents and settings\All Users\Application Data\Viewpoint
2009-05-16 03:21 . 2009-05-16 03:21 ——– d—–w- c:\program files\Gabest
2009-05-16 03:02 . 2008-01-26 06:32 ——– d—–w- c:\documents and settings\Lindsay\Application Data\DivX
2009-05-16 02:40 . 2008-01-07 00:24 ——– d—–w- c:\program files\DivX
2009-05-16 02:39 . 2009-04-21 00:33 ——– d—–w- c:\program files\Mozilla Thunderbird
2009-05-16 02:39 . 2009-05-16 02:39 ——– d—–w- c:\program files\Common Files\DivX Shared
2009-05-12 23:16 . 2009-05-12 23:16 ——– d—–w- c:\documents and settings\Lindsay\Application Data\vlc
2009-05-11 21:36 . 2009-05-11 21:36 ——– d—–w- c:\program files\AskBarDis
2009-05-11 21:36 . 2009-05-11 21:36 ——– d—–w- c:\program files\uTorrent
2009-05-07 15:44 . 2003-08-18 22:02 344064 —-a-w- c:\windows\system32\localspl.dll
2009-05-06 20:04 . 2009-05-06 20:04 ——– d—–w- c:\program files\Coupons
2009-04-29 04:56 . 2006-06-23 16:33 827392 —-a-w- c:\windows\system32\wininet.dll
2009-04-29 04:55 . 2004-08-04 07:56 78336 —-a-w- c:\windows\system32\ieencode.dll
2009-04-25 13:27 . 2009-04-25 13:27 ——– d—–w- c:\program files\Ask Search Assistant
2009-04-25 13:27 . 2009-01-03 02:06 ——– d—–w- c:\program files\Messenger Plus! Live
2009-04-24 04:07 . 2009-04-24 04:07 1878984 —-a-w- c:\documents and settings\George\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe
2009-04-17 09:58 . 2003-08-18 22:02 1846656 —-a-w- c:\windows\system32\win32k.sys
2009-04-15 20:24 . 2009-04-15 20:24 90112 —-a-w- c:\windows\system32\dpl100.dll
2009-04-15 20:24 . 2009-04-15 20:24 823296 —-a-w- c:\windows\system32\divx_xx0c.dll
2009-04-15 20:24 . 2009-04-15 20:24 823296 —-a-w- c:\windows\system32\divx_xx07.dll
2009-04-15 20:24 . 2009-04-15 20:24 815104 —-a-w- c:\windows\system32\divx_xx0a.dll
2009-04-15 20:24 . 2009-04-15 20:24 802816 —-a-w- c:\windows\system32\divx_xx11.dll
2009-04-15 20:24 . 2009-04-15 20:24 684032 —-a-w- c:\windows\system32\DivX.dll
2009-04-15 15:11 . 2004-03-06 02:16 584192 —-a-w- c:\windows\system32\rpcrt4.dll
2009-04-10 21:59 . 2009-04-10 21:59 15240 —-a-w- c:\documents and settings\Lindsay\Application Data\Microsoft\IdentityCRL\PROD\ppcrlconfig.dll
2009-03-27 14:58 . 2009-03-27 14:58 503808 —-a-w- c:\documents and settings\Dan\Application Data\Sun\Java\Deployment\cache\6.0\38\39ba6e6-34d5d5ca-n\msvcp71.dll
2009-03-27 14:58 . 2009-03-27 14:58 499712 —-a-w- c:\documents and settings\Dan\Application Data\Sun\Java\Deployment\cache\6.0\38\39ba6e6-34d5d5ca-n\jmc.dll
2009-03-27 14:58 . 2009-03-27 14:58 348160 —-a-w- c:\documents and settings\Dan\Application Data\Sun\Java\Deployment\cache\6.0\38\39ba6e6-34d5d5ca-n\msvcr71.dll
2009-03-27 14:56 . 2009-03-27 14:56 152576 —-a-w- c:\documents and settings\Dan\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-04-15 20:24 . 2009-04-15 20:24 1044480 —-a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-04-15 20:24 . 2009-04-15 20:24 200704 —-a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
2007-12-13 23:09 . 2007-12-13 23:09 32 –sha-w- c:\windows\{369E1060-78F8-42C0-BF0D-B952002141D6}.dat
2007-12-13 23:10 . 2007-12-13 23:10 32 –sha-w- c:\windows\{B400C221-1896-4500-B0B3-94FC46A96273}.dat
2007-12-13 23:10 . 2007-12-13 23:10 32 –sha-w- c:\windows\system32\{31445233-96EC-4031-A87E-BDC362BD647D}.dat
2007-12-13 23:09 . 2007-12-13 23:09 32 –sha-w- c:\windows\system32\{6277328A-3BA5-49F8-816B-E13ADB0754D0}.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A26503FE-B3B8-4910-A9DC-9CBD25C6B8D6}]
2009-04-02 21:14 3958088 —-a-w- c:\documents and settings\George\Local Settings\Application Data\CyberDefender\cdmyidd.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"Google Update"="c:\documents and settings\Dan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-25 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UserFaultCheck"="c:\windows\system32\dumprep 0 -u" [X]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-07-06 335872]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2003-07-16 4743168]
"ezShieldProtector for Px"="c:\windows\System32\ezSP_Px.exe" [2002-08-20 40960]
"ZTgServerSwitch"="c:\program files\support.com\client\bin\tgcmd.exe" [2003-06-24 1409024]
"IgfxTray"="c:\windows\System32\igfxtray.exe" [2003-04-07 155648]
"HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2003-04-07 114688]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2003-03-03 54520]
"ccRegVfy"="c:\program files\Common Files\Symantec Shared\ccRegVfy.exe" [2003-03-03 58616]
"VAIO Recovery"="c:\windows\Sonysys\VAIO Recovery\PartSeal.exe" [2003-04-20 28672]
"LXBUCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\LXBUtime.dll" [2004-08-20 65536]
"lxbumon.exe"="c:\program files\Lexmark 6200 Series\lxbumon.exe" [2004-08-20 188416]
"FaxCenterServer"="c:\program files\Lexmark Fax Solutions\fm3032.exe" [2004-08-24 299008]
"EzPrint"="c:\program files\Lexmark 6200 Series\ezprint.exe" [2004-08-24 61440]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2006-03-22 1191936]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-01-06 290088]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"ATIModeChange"="Ati2mdxx.exe" - c:\windows\system32\Ati2mdxx.exe [2001-09-04 28672]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2003-07-16 323584]
"CTHelper"="CTHELPER.EXE" - c:\windows\system32\cthelper.exe [2003-07-03 28672]
"AGRSMMSG"="AGRSMMSG.exe" - c:\windows\AGRSMMSG.exe [2003-05-23 88363]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"SetDefaultMidi"="MIDIDEF.EXE" - c:\windows\mididef.exe [2003-07-03 49152]

c:\documents and settings\Andrew\Start Menu\Programs\Startup\
OpenOffice.org 2.4.lnk - c:\program files\OpenOffice.org 2.4\program\quickstart.exe [2008-1-21 393216]

c:\documents and settings\Lindsay\Start Menu\Programs\Startup\
OpenOffice.org 3.0.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2008-9-12 384000]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Billminder.lnk - c:\program files\Quicken\billmind.exe [2002-9-20 36864]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 16:05 356352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Quicken Scheduled Updates.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Quicken Scheduled Updates.lnk
backup=c:\windows\pss\Quicken Scheduled Updates.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Quicken Startup.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Quicken Startup.lnk
backup=c:\windows\pss\Quicken Startup.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\support.com\\client\\bin\\tgcmd.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Documents and Settings\\Lindsay\\Application Data\\Macromedia\\Flash Player\\www.macromedia.com\\bin\\octoshape\\octoshape.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Real\\RealOne Player\\realplay.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\Tencent\\QQ Games\\QQGames.exe"=
"c:\\Program Files\\Tencent\\QQ Games\\QQGamesD.exe"=
"c:\\Program Files\\Tencent\\QQ Games\\Update\\Update.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R1 RapportPG;RapportPG;c:\program files\Trusteer\Rapport\bin\RapportPG.sys [1/3/2009 10:17 AM 69224]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [5/26/2009 10:05 AM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/26/2009 10:05 AM 72944]
R2 ccPxySvc;Symantec Proxy Service;c:\program files\Norton Internet Security\ccPxySvc.exe [3/3/2003 2:05 PM 34040]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [12/13/2007 10:33 PM 24652]
R3 RapportKE;RapportKE;c:\program files\Trusteer\Rapport\bin\RapportKE.sys [1/3/2009 10:17 AM 106472]
S2 ASKUpgrade;ASKUpgrade;c:\program files\AskBarDis\bar\bin\ASKUpgrade.exe [5/11/2009 5:36 PM 234888]
S2 mrtRate;mrtRate; [x]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [5/26/2009 10:05 AM 7408]
.
Contents of the 'Scheduled Tasks' folder

2009-06-18 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

2009-06-20 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 16:20]

2009-06-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1255920486-560898740-3130408052-1005.job
- c:\documents and settings\Dan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-25 04:18]

2009-06-20 c:\windows\Tasks\Norton AntiVirus - Scan my computer.job
- c:\progra~1\NORTON~1\NAVW32.exe [2003-03-03 18:06]

2009-06-20 c:\windows\Tasks\Symantec NetDetect.job
- c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2007-12-13 14:04]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.sony.com/vaiopeople
uInternet Settings,ProxyOverride = *.local
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath -
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-20 00:40
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
LXBUCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\LXBUtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
@DACL=(02 0000)
"Installed"="1"
@=""

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
@DACL=(02 0000)
"NoChange"="1"
"Installed"="1"
@=""

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
@DACL=(02 0000)
"Installed"="1"
@=""
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(716)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
.
Completion time: 2009-06-20 0:45
ComboFix-quarantined-files.txt 2009-06-20 04:45
ComboFix2.txt 2009-06-19 17:57

Pre-Run: 4,719,038,464 bytes free
Post-Run: 4,791,537,664 bytes free

265 — E O F — 2009-06-10 07:04


DDS (Ver_09-05-14.01) - NTFSx86
Run by [removed] at 0:49:06.79 on Sat 06/20/2009
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_13
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1023.545 [GMT -4:00]

AV: Norton AntiVirus *On-access scanning disabled* (Outdated) {B5510F6F-87E1-47F7-A411-360BC453007C}
FW: Norton Internet Security *disabled* {E641AC2D-955F-4A05-ABE7-F9C534ABDB46}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Norton Internet Security\NISUM.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\Norton Internet Security\ccPxySvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Documents and Settings\Dan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Java\jre6\bin\java.exe
C:\Documents and Settings\Dan\Desktop\dds.pif

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.sony.com/vaiopeople
uInternet Settings,ProxyOverride = *.local
mURLSearchHooks: AIM Toolbar Search Class: {03402f96-3dc7-4285-bc50-9e81fefafe43} - c:\program files\aim toolbar\aimtb.dll
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: SpywareGuardDLBLOCK.CBrowserHelper: {4a368e80-174f-4872-96b5-0b27ddd11db2} - d:\program files\spywareguard\dlprotect.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: EWPBrowseObject Class: {68f9551e-0411-48e4-9aaf-4bc42a6a46be} - c:\program files\canon\easy-webprint\EWPBrowseLoader.dll
BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: MyIdentityDefender: {a26503fe-b3b8-4910-a9dc-9cbd25c6b8d6} - c:\documents and settings\george\local settings\application data\cyberdefender\cdmyidd.dll
BHO: Windows Live Toolbar Helper: {bdbd1dad-c946-4a17-adc1-64b5b4ff55d0} - c:\program files\windows live toolbar\msntb.dll
BHO: 1 (0x1) - No File
BHO: CNavExtBho Class: {bdf3e430-b101-42ad-a544-fadc6b084872} - c:\program files\norton antivirus\NavShExt.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\progra~1\yahoo!\companion\installs\cpn\YTSingleInstance.dll
BHO: {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - No File
TB: Norton AntiVirus: {42cdd1bf-3ffb-4238-8ad1-7859df00b1d6} - c:\program files\norton antivirus\NavShExt.dll
TB: Windows Live Toolbar: {bdad1dad-c946-4a17-adc1-64b5b4ff55d0} - c:\program files\windows live toolbar\msntb.dll
TB: Easy-WebPrint: {327c2873-e90d-4c37-aa9d-10ac9baba46c} - c:\program files\canon\easy-webprint\Toolband.dll
TB: AIM Toolbar: {61539ecd-cc67-4437-a03c-9aaccbd14326} - c:\program files\aim toolbar\aimtb.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll
TB: MyIdentityDefender: {a26503fe-b3b8-4910-a9dc-9cbd25c6b8d6} - c:\documents and settings\george\local settings\application data\cyberdefender\cdmyidd.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Google Update] "c:\documents and settings\dan\local settings\application data\google\update\GoogleUpdate.exe" /c
mRun: [ATIModeChange] Ati2mdxx.exe
mRun: [ATIPTA] c:\program files\ati technologies\ati control panel\atiptaxx.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /installquiet
mRun: [ezShieldProtector for Px] c:\windows\system32\ezSP_Px.exe
mRun: [ZTgServerSwitch] "c:\program files\support.com\client\bin\tgcmd.exe" /server
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [CTHelper] CTHELPER.EXE
mRun: [AGRSMMSG] AGRSMMSG.exe
mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe"
mRun: [ccRegVfy] "c:\program files\common files\symantec shared\ccRegVfy.exe"
mRun: [VAIO Recovery] c:\windows\sonysys\vaio recovery\PartSeal.exe
mRun: [LXBUCATS] rundll32 c:\windows\system32\spool\drivers\w32x86\3\LXBUtime.dll,_RunDLLEntry@16
mRun: [lxbumon.exe] "c:\program files\lexmark 6200 series\lxbumon.exe"
mRun: [FaxCenterServer] "c:\program files\lexmark fax solutions\fm3032.exe" /s
mRun: [EzPrint] "c:\program files\lexmark 6200 series\ezprint.exe"
mRun: [CanonMyPrinter] c:\program files\canon\myprinter\BJMyPrt.exe /logon
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
dRunOnce: [SetDefaultMidi] MIDIDEF.EXE
StartupFolder: c:\docume~1\dan\startm~1\programs\startup\openof~1.lnk - c:\program files\openoffice.org 2.3\program\quickstart.exe
StartupFolder: c:\docume~1\dan\startm~1\programs\startup\spywar~1.lnk - d:\program files\spywareguard\sgmain.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\billmi~1.lnk - c:\program files\quicken\billmind.exe
IE: {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - c:\program files\aim95\aim.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {0b83c99c-1efa-4259-858f-bcb33e007a5b} - {61539ecd-cc67-4437-a03c-9aaccbd14326} - c:\program files\aim toolbar\aimtb.dll
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1197607749640
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_04-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll
Notify: igfxcui - igfxsrvc.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\dan\applic~1\mozilla\firefox\profiles\xd15le4q.default\
FF - plugin: c:\documents and settings\dan\local settings\application data\google\update\1.2.145.5\npGoogleOneClick8.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npCouponPrinter.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdnu.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\photosynth\npPhotosynthMozilla.dll
FF - plugin: c:\program files\real\realone player\netscape6\nppl3260.dll
FF - plugin: c:\program files\real\realone player\netscape6\nprjplug.dll
FF - plugin: c:\program files\real\realone player\netscape6\nprpjplug.dll
FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll

—- FIREFOX POLICIES —-
FF - user.js: yahoo.homepage.dontask - true
============= SERVICES / DRIVERS ===============

R1 RapportPG;RapportPG;c:\program files\trusteer\rapport\bin\RapportPG.sys [2009-1-3 69224]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2009-5-26 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2009-5-26 72944]
R2 ccEvtMgr;Symantec Event Manager;c:\program files\common files\symantec shared\ccEvtMgr.exe [2003-2-21 316672]
R2 ccPxySvc;Symantec Proxy Service;c:\program files\norton internet security\ccPxySvc.exe [2003-3-3 34040]
R2 SAVRTPEL;SAVRTPEL;c:\windows\system32\drivers\SAVRTPEL.SYS [2002-7-25 35552]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2007-12-13 24652]
R3 RapportKE;RapportKE;c:\program files\trusteer\rapport\bin\RapportKE.sys [2009-1-3 106472]
S2 ASKUpgrade;ASKUpgrade;c:\program files\askbardis\bar\bin\ASKUpgrade.exe [2009-5-11 234888]
S2 mrtRate;mrtRate; [x]
S3 ccPwdSvc;Symantec Password Validation Service;c:\program files\common files\symantec shared\ccPwdSvc.exe [2003-3-3 99576]
S3 navapsvc;Norton AntiVirus Auto Protect Service;c:\program files\norton antivirus\Navapsvc.exe [2003-3-3 115872]
S3 NAVENG;NAVENG;c:\progra~1\common~1\symant~1\virusd~1\20080312.003\NAVENG.Sys [2008-3-12 82256]
S3 NAVEX15;NAVEX15;c:\progra~1\common~1\symant~1\virusd~1\20080312.003\NavEx15.Sys [2008-3-12 895408]
S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2009-5-26 7408]
S3 SAVRT;SAVRT;c:\windows\system32\drivers\SAVRT.SYS [2002-7-25 235744]

=============== Created Last 30 ================

2009-06-20 00:36 –ds—- C:\Combo-Fix
2009-06-19 13:28 a-dshr– C:\cmdcons
2009-06-19 13:26 161,792 a——- c:\windows\SWREG.exe
2009-06-19 13:26 155,136 a——- c:\windows\PEV.exe
2009-06-19 13:26 98,816 a——- c:\windows\sed.exe
2009-06-15 09:28 –d—– c:\docume~1\alluse~1\applic~1\Azureus
2009-06-15 09:27 –d—– c:\program files\Vuze
2009-06-14 17:15 –d—– c:\program files\CCleaner
2009-06-14 15:51 –d—– c:\docume~1\dan\applic~1\Malwarebytes
2009-06-14 15:51 38,160 a——- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-14 15:51 19,096 a——- c:\windows\system32\drivers\mbam.sys
2009-06-14 15:51 –d—– c:\program files\Malwarebytes' Anti-Malware
2009-06-14 15:51 –d—– c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-06-14 13:10 –d—– c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com
2009-06-14 13:10 –d—– c:\program files\SUPERAntiSpyware
2009-06-14 13:10 –d—– c:\docume~1\dan\applic~1\SUPERAntiSpyware.com
2009-06-14 13:09 –d—– c:\program files\common files\Wise Installation Wizard
2009-06-14 11:51 –d—– c:\docume~1\dan\applic~1\QQ Games Plugin
2009-06-13 17:08 –d—– c:\docume~1\alluse~1\applic~1\98178276
2009-06-13 13:47 –d—– c:\program files\Tencent
2009-06-13 13:47 –d—– c:\docume~1\alluse~1\applic~1\Tencent
2009-06-04 15:41 56 a—h— c:\windows\system32\ezsidmv.dat
2009-06-04 15:39 –d–r– c:\program files\Skype
2009-05-30 23:54 –d—– c:\program files\HyCam2
2009-05-30 18:37 –d—– c:\program files\Microsoft Kids
2009-05-24 20:13 –d-h— c:\windows\PIF

==================== Find3M ====================

2009-05-07 11:44 344,064 a——- c:\windows\system32\localspl.dll
2009-04-29 00:56 827,392 a——- c:\windows\system32\wininet.dll
2009-04-29 00:55 78,336 a——- c:\windows\system32\ieencode.dll
2009-04-17 05:58 1,846,656 a——- c:\windows\system32\win32k.sys
2009-04-15 16:24 90,112 a——- c:\windows\system32\dpl100.dll
2009-04-15 16:24 823,296 a——- c:\windows\system32\divx_xx0c.dll
2009-04-15 16:24 823,296 a——- c:\windows\system32\divx_xx07.dll
2009-04-15 16:24 815,104 a——- c:\windows\system32\divx_xx0a.dll
2009-04-15 16:24 802,816 a——- c:\windows\system32\divx_xx11.dll
2009-04-15 16:24 684,032 a——- c:\windows\system32\DivX.dll
2009-04-15 11:11 584,192 a——- c:\windows\system32\rpcrt4.dll
2007-12-13 19:09 32 a–sh— c:\windows\{369E1060-78F8-42C0-BF0D-B952002141D6}.dat
2007-12-13 19:10 32 a–sh— c:\windows\{B400C221-1896-4500-B0B3-94FC46A96273}.dat
2007-12-13 19:10 32 a–sh— c:\windows\system32\{31445233-96EC-4031-A87E-BDC362BD647D}.dat
2007-12-13 19:09 32 a–sh— c:\windows\system32\{6277328A-3BA5-49F8-816B-E13ADB0754D0}.dat

============= FINISH: 0:50:02.59 ===============