Spyware / Malware / Virus Removal

[Resolved] HJT Log

5 min read

Looking for the outcome? Ask AI

regulate3210 Topic Starter

Post #1September 3, 2009, 8:00 AM UTC

My system will "stall out" when i go to open a application. It will still respond as far as opening start menu, right clicking desktop options, but the stall'd program will not show up on the screen, only a tab on the start menu. To get the application to start up I have had to open task manager and delete iexplorer.exe. The program will then begin working at full speed like there was no problem.
Task manager will at times show 3 different iexplorer.exe open when i only have 1 actualy Internet explorer window open. Its not that big of a problem, but I was hoping someone could take a glance. Also, I dont know if this log is enough information to determine, but I was hoping to cut down some unnecessary services/processes. The computer is used for email, basic web browsing (no youtube/video sites), and games no more complicated then digdug. Thanks in advance.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:56:02 PM, on 9/2/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\libusbd-nt.exe
C:\Program Files\Norton 360\Engine\3.5.2.10\ccSvcHst.exe
C:\WINDOWS\system32\oodag.exe
C:\Program Files\Norton 360\Engine\3.5.2.10\ccSvcHst.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Linksys\WUSB600N\WUSB600N.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\LibUSB-Win32-0.1.10.1\bin\testlibusb-win.exe
C:\Program Files\Xpadder\Xpadder.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=2061210
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360\Engine\3.5.2.10\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360\Engine\3.5.2.10\IPSBHO.DLL
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\3.5.2.10\coIEPlg.dll
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKUS\S-1-5-21-3562891378-3382784536-2106522743-500\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Administrator')
O4 - HKUS\S-1-5-21-3562891378-3382784536-2106522743-500\..\RunOnce: [NeroHomeFirstStart] "C:\Program Files\Common Files\Nero\Lib\NMFirstStart.exe" (User 'Administrator')
O4 - HKUS\S-1-5-18\..\RunOnce: [WUAppSetup] C:\Program Files\Common Files\logishrd\WUApp32.exe -v 0x046d -p 0x0990 -f video -m logitech -d 11.90.1262.0 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [WUAppSetup] C:\Program Files\Common Files\logishrd\WUApp32.exe -v 0x046d -p 0x0990 -f video -m logitech -d 11.90.1262.0 (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.systemrequirementslab.com/srl_b…sreqlab_srl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1228048735531
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1240414942752
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownlo…iaSmartScan.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} -
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {E5ABEB00-B357-4884-9949-77B2C71A7EE3} (BoardCtl Class) - http://www.intel.com/design/motherbd/boardid/BoardID.cab
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton 360\Engine\3.5.2.10\coIEPlg.dll
O20 - AppInit_DLLs:
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LibUsb-Win32 - Daemon, Version 0.1.10.1 (libusbd) - http://libusb-win32.sourceforge.net - C:\WINDOWS\system32\libusbd-nt.exe
O23 - Service: Norton 360 (N360) - Symantec Corporation - C:\Program Files\Norton 360\Engine\3.5.2.10\ccSvcHst.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: Roxio UPnP Renderer 10 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe
O23 - Service: Roxio Upnp Server 10 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 10\RoxioUpnpService10.exe
O23 - Service: LiveShare P2P Server 10 (RoxLiveShare10) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe
O23 - Service: RoxMediaDB10 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe
O23 - Service: Roxio Hard Drive Watcher 10 (RoxWatch10) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatch10.exe
O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\WINDOWS\System32\TUProgSt.exe

–
End of file - 6889 bytes

LDTate

Post #2September 6, 2009, 6:34 PM UTC

[external image: Posted Image]

DO NOT use any TOOLS such as Combofix, Vundofix, or HijackThis fixes without supervision.

Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.

The issues with your computer that you list, doesn't appear to be related to Malware/Spyware/Virus but we can have a look.

Stay with this topic until I give you the all clean post.

You might want to print these instructions out.

I suggest you do this:

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Uncheck "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Uncheck "Hide protected operating system files."
Click Apply, and then click OK.

Please do not delete anything unless instructed to.

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
[external image: Posted Image]
Click the Empty Selected button.

(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.

Next:

Please download Malwarebytes' Anti-Malware to your desktop.

Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan.
[external image: Posted Image]
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected .
When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.

Also "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.

Please don't attach the scans / logs, use "copy/paste". .

regulate3210

Post #3September 7, 2009, 6:25 AM UTC

Malwarebytes' Anti-Malware 1.40
Database version: 2750
Windows 5.1.2600 Service Pack 3

9/7/2009 12:14:02 AM
mbam-log-2009-09-07 (00-14-02).txt

Scan type: Quick Scan
Objects scanned: 103304
Time elapsed: 44 minute(s), 39 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 2
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_CLASSES_ROOT\scrfile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: (NOTEPAD.EXE %1) Good: ("%1" /S) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\regfile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: (NOTEPAD.EXE %1) Good: (regedit.exe "%1") -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

____________________________________________________________________________

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:24:33 AM, on 9/7/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\libusbd-nt.exe
C:\Program Files\Norton 360\Engine\3.5.2.10\ccSvcHst.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\system32\sessmgr.exe
C:\Program Files\Norton 360\Engine\3.5.2.10\ccSvcHst.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=2061210
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360\Engine\3.5.2.10\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360\Engine\3.5.2.10\IPSBHO.DLL
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\3.5.2.10\coIEPlg.dll
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [WUAppSetup] C:\Program Files\Common Files\logishrd\WUApp32.exe -v 0x046d -p 0x0990 -f video -m logitech -d 11.90.1262.0 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [WUAppSetup] C:\Program Files\Common Files\logishrd\WUApp32.exe -v 0x046d -p 0x0990 -f video -m logitech -d 11.90.1262.0 (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownlo…iaSmartScan.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {E5ABEB00-B357-4884-9949-77B2C71A7EE3} (BoardCtl Class) - http://www.intel.com/design/motherbd/boardid/BoardID.cab
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton 360\Engine\3.5.2.10\coIEPlg.dll
O20 - AppInit_DLLs:
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LibUsb-Win32 - Daemon, Version 0.1.10.1 (libusbd) - http://libusb-win32.sourceforge.net - C:\WINDOWS\system32\libusbd-nt.exe
O23 - Service: Norton 360 (N360) - Symantec Corporation - C:\Program Files\Norton 360\Engine\3.5.2.10\ccSvcHst.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: Roxio UPnP Renderer 10 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe
O23 - Service: Roxio Upnp Server 10 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 10\RoxioUpnpService10.exe
O23 - Service: RoxMediaDB10 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe
O23 - Service: Roxio Hard Drive Watcher 10 (RoxWatch10) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatch10.exe

–
End of file - 5901 bytes

Thank you very much for taking the time to help.

LDTate

Post #4September 7, 2009, 1:11 PM UTC

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs
Double click on ComboFix.exe & follow the prompts.

Note: Combofix will run without the Recovery Console installed.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
"copy/paste" a new HijackThis log file into this thread as well.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Give it atleast 20-30 minutes to finish if needed.

Also please describe how your computer behaves at the moment.

regulate3210

Post #5September 8, 2009, 8:30 AM UTC

ComboFix 09-09-07.03 - This Guy 09/08/2009 2:13.1.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2942.2321 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: Norton 360 *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton 360 *enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
.
ADS - svchost.exe: deleted 88 bytes in 2 streams.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\This Guy\Start Menu\Programs\Startup\Logitech . Product Registration.lnk
c:\program files\INSTALL.LOG
c:\windows\Installer\112d2.msi
c:\windows\Installer\8e40.msi
c:\windows\Installer\a652151.msi
c:\windows\kb913800.exe
c:\windows\system32\Cache

.
((((((((((((((((((((((((( Files Created from 2009-08-08 to 2009-09-08 )))))))))))))))))))))))))))))))
.

2009-09-08 07:49 . 2009-09-08 07:49 ——– d—–w- c:\documents and settings\This Guy\Application Data\Logitech
2009-09-08 07:48 . 2009-09-08 07:48 ——– d—–w- c:\documents and settings\This Guy\Application Data\Leadertech
2009-09-08 07:48 . 2009-06-17 16:55 10384 —-a-w- c:\windows\system32\drivers\LBeepKE.sys
2009-09-08 07:47 . 2009-09-08 07:48 ——– d—–w- c:\windows\LastGood
2009-09-08 07:47 . 2009-07-20 18:25 301656 —-a-w- c:\windows\system32\BtCoreIf.dll
2009-09-08 07:47 . 2009-07-20 18:26 84496 —-a-w- c:\windows\system32\KemXML.dll
2009-09-08 07:47 . 2009-07-20 18:26 117264 —-a-w- c:\windows\system32\KemWnd.dll
2009-09-08 07:47 . 2009-07-20 18:26 145936 —-a-w- c:\windows\system32\KemUtil.dll
2009-09-08 07:47 . 2009-07-20 18:26 170512 —-a-w- c:\windows\system32\kemutb.dll
2009-09-08 07:47 . 2009-09-08 07:47 ——– d—–w- c:\documents and settings\All Users\Application Data\Logitech
2009-09-08 07:47 . 2009-09-08 07:47 ——– d—–w- c:\program files\Logitech
2009-09-07 05:26 . 2009-08-03 19:36 38160 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-07 05:26 . 2009-09-07 05:26 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-09-07 05:26 . 2009-08-03 19:36 19096 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-09-03 13:48 . 2008-10-16 20:06 208744 —-a-w- c:\windows\system32\muweb.dll
2009-09-03 09:46 . 2009-09-03 09:46 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\Symantec
2009-09-03 06:04 . 2009-09-03 06:04 ——– d—–w- c:\program files\ERUNT
2009-09-03 05:39 . 2009-09-03 05:39 ——– d—–w- c:\program files\Trend Micro
2009-09-02 19:27 . 2009-09-02 19:27 ——– d—–w- c:\windows\nview
2009-09-02 19:27 . 2008-09-18 05:55 453152 —-a-w- c:\windows\system32\nvuninst.exe
2009-09-02 19:27 . 2008-09-18 05:55 453152 —-a-w- c:\windows\system32\nvudisp.exe
2009-09-01 19:40 . 2009-09-02 19:45 ——– d—–w- c:\program files\ChickenInvadersROTYXmas
2009-09-01 14:23 . 2009-09-01 14:50 ——– d—–w- c:\program files\Chicken Invaders 2
2009-09-01 02:52 . 2009-06-25 08:25 54272 ——w- c:\windows\system32\dllcache\wdigest.dll
2009-09-01 02:52 . 2009-06-25 08:25 301568 ——w- c:\windows\system32\dllcache\kerberos.dll
2009-09-01 02:52 . 2009-06-25 08:25 136192 ——w- c:\windows\system32\dllcache\msv1_0.dll
2009-09-01 02:52 . 2009-06-24 11:18 92928 ——w- c:\windows\system32\dllcache\ksecdd.sys
2009-08-30 15:54 . 2009-08-30 15:54 ——– d—–w- c:\program files\LibUSB-Win32-0.1.10.1
2009-08-30 15:54 . 2005-03-10 02:50 19456 —-a-w- c:\windows\system32\libusbd-9x.exe
2009-08-30 15:54 . 2005-03-10 02:50 18944 —-a-w- c:\windows\system32\libusbd-nt.exe
2009-08-29 01:32 . 2008-04-13 23:12 53760 —-a-w- c:\windows\system32\vfwwdm32.dll
2009-08-29 01:32 . 2008-04-13 23:12 53760 —-a-w- c:\windows\system32\dllcache\vfwwdm32.dll
2009-08-28 11:37 . 2009-08-28 11:37 0 —-a-w- c:\windows\ativpsrm.bin
2009-08-28 11:36 . 2009-08-28 11:36 ——– d—–w- c:\documents and settings\All Users\Application Data\ATI
2009-08-28 10:36 . 2009-08-28 10:36 ——– d—–w- c:\program files\Common Files\ATI Technologies
2009-08-28 10:34 . 2009-04-28 03:20 593920 ——w- c:\windows\system32\ati2sgag.exe
2009-08-28 10:20 . 2009-04-28 03:58 307200 —-a-w- c:\windows\system32\atiiiexx.dll
2009-08-28 10:20 . 2009-04-23 21:29 189051 —-a-w- c:\windows\system32\atiicdxx.dat
2009-08-28 10:20 . 2006-12-17 02:30 3107788 —-a-r- c:\windows\system32\ativvaxx.dat
2009-08-25 04:55 . 2009-08-25 04:55 ——– d—–w- c:\documents and settings\This Guy\Application Data\iWin
2009-08-25 04:54 . 2009-08-25 04:54 ——– d—–w- c:\program files\iWin.com
2009-08-23 07:04 . 2009-08-23 12:33 ——– d—–w- c:\program files\Xpadder
2009-08-23 03:20 . 2008-12-17 06:01 6364440 —-a-w- c:\windows\system32\drivers\lvuvc.sys
2009-08-23 03:20 . 2008-12-17 06:01 41752 —-a-w- c:\windows\system32\drivers\LVUSBSta.sys
2009-08-23 03:20 . 2008-12-17 06:01 432664 —-a-w- c:\windows\system32\LVUI2RC.dll
2009-08-23 03:20 . 2008-12-17 06:00 494104 —-a-w- c:\windows\system32\LVUI2.dll
2009-08-23 03:20 . 2008-12-17 05:55 195096 —-a-w- c:\windows\system32\lvci11901262.dll
2009-08-23 03:20 . 2008-12-17 05:55 416280 —-a-w- c:\windows\system32\lvcodec2.dll
2009-08-23 03:20 . 2008-12-17 06:00 768024 —-a-w- c:\windows\system32\drivers\lvrs.sys
2009-08-23 03:20 . 2008-12-17 05:37 29562 —-a-w- c:\windows\system32\Repository.reg
2009-08-23 03:20 . 2008-12-17 06:02 23832 —-a-w- c:\windows\system32\drivers\lvuvcflt.sys
2009-08-22 06:38 . 2009-08-22 06:38 ——– d—–w- c:\documents and settings\This Guy\Local Settings\Application Data\Thinstall
2009-08-22 06:38 . 2009-08-22 06:38 ——– d—–w- c:\documents and settings\This Guy\Application Data\Thinstall
2009-08-21 14:47 . 2009-08-21 14:59 1140850688 –sha-w- C:\NRTPage.sys
2009-08-21 13:20 . 2009-08-21 13:20 36400 —-a-r- c:\windows\system32\drivers\SymIM.sys
2009-08-21 13:20 . 2009-08-21 13:20 60808 —-a-w- c:\windows\system32\S32EVNT1.DLL
2009-08-21 13:20 . 2009-08-21 13:20 124976 —-a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2009-08-21 13:20 . 2009-08-21 13:20 ——– d—–w- c:\program files\Symantec
2009-08-21 13:19 . 2009-08-21 13:19 ——– d—–w- c:\windows\system32\drivers\N360
2009-08-21 13:19 . 2009-08-21 13:20 ——– d—–w- c:\program files\Norton 360
2009-08-21 13:19 . 2009-08-21 13:19 ——– d—–w- c:\program files\Windows Sidebar
2009-08-21 13:19 . 2009-08-21 13:19 ——– d—–w- c:\program files\NortonInstaller
2009-08-21 11:18 . 2009-08-23 12:09 ——– d—–w- c:\documents and settings\This Guy\Local Settings\Application Data\RcIncidents
2009-08-19 17:02 . 2009-08-19 17:02 ——– d—–w- c:\documents and settings\LocalService\Local Settings\Application Data\Downloaded Installations
2009-08-18 06:44 . 2009-08-18 06:44 ——– d—–w- c:\documents and settings\All Users\Application Data\NVIDIA Corporation
2009-08-18 06:44 . 2009-08-18 06:44 ——– d—–w- c:\program files\NVIDIA Corporation
2009-08-18 06:44 . 2006-03-29 14:51 60416 —-a-w- c:\windows\system32\DSETUP.dll
2009-08-18 06:44 . 2006-03-29 14:50 671744 —-a-w- c:\windows\system32\DolbyHph.dll
2009-08-18 06:44 . 2006-03-29 14:49 9856 —-a-w- c:\windows\system32\drivers\pfc.sys
2009-08-17 05:59 . 2009-08-17 06:00 ——– d—–w- c:\program files\Program
2009-08-17 01:27 . 2009-07-10 13:27 1315328 ——w- c:\windows\system32\dllcache\msoe.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-08 08:13 . 2009-06-10 02:57 ——– d—–w- c:\documents and settings\This Guy\Application Data\uTorrent
2009-09-08 07:48 . 2008-12-18 05:04 ——– d—–w- c:\program files\Common Files\Logishrd
2009-09-08 07:48 . 2008-12-18 05:05 ——– d—–w- c:\documents and settings\All Users\Application Data\LogiShrd
2009-09-08 07:47 . 2009-09-08 07:47 0 —ha-w- c:\windows\system32\drivers\Msft_Kernel_LHidEqd_01005.Wdf
2009-09-08 07:47 . 2009-09-08 07:47 0 —ha-w- c:\windows\system32\drivers\Msft_Kernel_LEqdUsb_01005.Wdf
2009-09-08 07:47 . 2006-12-10 18:24 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-09-07 06:41 . 2006-12-10 18:45 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-09-03 08:11 . 2009-05-22 19:11 10748 –sha-w- c:\windows\system32\drivers\fidbox2.idx
2009-09-03 08:11 . 2009-05-22 19:11 103200 –sha-w- c:\windows\system32\drivers\fidbox2.dat
2009-09-03 08:11 . 2009-05-22 19:11 49556 –sha-w- c:\windows\system32\drivers\fidbox.idx
2009-09-03 08:11 . 2009-05-22 19:11 3619872 –sha-w- c:\windows\system32\drivers\fidbox.dat
2009-09-03 08:09 . 2009-04-19 10:13 ——– d—–w- c:\program files\WebEx
2009-09-03 02:08 . 2009-05-22 19:00 ——– d—–w- c:\program files\Common Files\ParetoLogic
2009-09-01 15:43 . 2009-02-12 18:01 10 —-a-w- c:\windows\popcinfo.dat
2009-09-01 14:59 . 2009-07-07 17:03 ——– d—–w- c:\documents and settings\This Guy\Application Data\Any DVD Converter Professional
2009-08-30 03:16 . 2009-08-30 03:16 0 —ha-w- c:\windows\system32\drivers\Msft_Kernel_motport_01005.Wdf
2009-08-30 03:15 . 2009-08-30 03:15 0 —ha-w- c:\windows\system32\drivers\Msft_Kernel_motmodem_01005.Wdf
2009-08-30 03:14 . 2009-08-30 03:14 0 —ha-w- c:\windows\system32\drivers\Msft_Kernel_motccgpfl_01005.Wdf
2009-08-30 03:14 . 2009-08-30 03:14 0 —ha-w- c:\windows\system32\drivers\Msft_Kernel_motccgp_01005.Wdf
2009-08-29 04:21 . 2009-02-18 16:57 ——– d—–w- c:\documents and settings\All Users\Application Data\Roxio
2009-08-29 01:32 . 2009-08-29 01:32 0 —-a-w- c:\windows\system32\drivers\lvuvc.hs
2009-08-29 01:32 . 2009-08-29 01:32 0 —-a-w- c:\windows\system32\drivers\logiflt.iad
2009-08-28 12:32 . 2008-11-30 17:04 ——– d—–w- c:\program files\AMD
2009-08-28 11:36 . 2009-05-02 15:19 ——– d—–w- c:\documents and settings\This Guy\Application Data\ATI
2009-08-28 11:32 . 2009-04-21 22:52 ——– d—–w- c:\program files\SystemRequirementsLab
2009-08-28 11:22 . 2009-05-02 15:15 ——– d—–w- c:\program files\ATI Technologies
2009-08-23 12:15 . 2009-04-14 09:19 ——– d—–w- c:\program files\iolo
2009-08-23 12:14 . 2009-04-14 09:16 ——– d—–w- c:\documents and settings\All Users\Application Data\iolo
2009-08-23 12:12 . 2009-04-13 07:34 ——– d—–w- c:\program files\Reflexive Arcade Games - Word
2009-08-23 12:12 . 2009-04-10 10:16 ——– d—–w- c:\program files\Reflexive Arcade Games - Shooter
2009-08-23 12:11 . 2009-04-10 10:38 ——– d—–w- c:\program files\Reflexive Arcade Games - Puzzle
2009-08-23 12:09 . 2009-04-11 05:10 ——– d—–w- c:\program files\Reflexive Arcade Games - Action
2009-08-21 13:31 . 2006-12-10 18:31 ——– d—–w- c:\program files\Common Files\Symantec Shared
2009-08-21 13:20 . 2009-08-21 13:20 806 —-a-w- c:\windows\system32\drivers\SYMEVENT.INF
2009-08-21 13:20 . 2009-08-21 13:20 7456 —-a-w- c:\windows\system32\drivers\SYMEVENT.CAT
2009-08-21 13:20 . 2008-01-29 19:01 26600 —-a-r- c:\windows\system32\drivers\GEARAspiWDM.sys
2009-08-21 13:20 . 2008-01-29 19:02 107368 —-a-r- c:\windows\system32\GEARAspi.dll
2009-08-21 13:19 . 2009-05-13 18:19 ——– d—–w- c:\documents and settings\All Users\Application Data\NortonInstaller
2009-08-17 09:02 . 2009-04-10 05:25 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-08-17 03:31 . 2005-08-16 10:18 15360 —-a-w- c:\windows\system32\ctfmon.exe
2009-08-17 03:22 . 2009-01-04 03:58 ——– d-sh–w- c:\documents and settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357}
2009-08-05 13:53 . 2006-12-10 18:30 ——– d—–w- c:\program files\WildTangent
2009-08-05 09:01 . 2005-08-16 10:18 204800 —-a-w- c:\windows\system32\mswebdvd.dll
2009-08-05 07:25 . 2009-08-05 07:25 ——– d—–w- c:\program files\WildTangent Games
2009-08-05 05:49 . 2009-08-02 09:03 ——– d—–w- c:\documents and settings\All Users\Application Data\WildTangent
2009-08-05 01:02 . 2009-07-05 18:45 ——– d—–w- c:\documents and settings\This Guy\Application Data\Any Video Converter
2009-07-28 22:35 . 2009-07-26 00:35 ——– d—–w- c:\documents and settings\All Users\Application Data\NOS
2009-07-25 18:10 . 2009-07-25 18:10 ——– d—–w- c:\documents and settings\This Guy\Application Data\WinBatch
2009-07-25 01:26 . 2009-07-07 17:03 ——– d—–w- c:\program files\Any DVD Converter Professional
2009-07-24 23:41 . 2009-06-09 15:57 604488 —-a-w- c:\windows\system32\TUProgSt.exe
2009-07-21 18:05 . 2009-06-22 12:14 25 —-a-w- c:\windows\popcinfot.dat
2009-07-21 18:05 . 2009-06-21 14:41 74 —-a-w- c:\program files\updates.xml
2009-07-18 15:49 . 2009-02-18 17:20 ——– d—–w- c:\documents and settings\This Guy\Application Data\Roxio
2009-07-18 15:49 . 2008-12-15 04:22 ——– d—–w- c:\documents and settings\This Guy\Application Data\Azureus
2009-07-17 19:01 . 2005-08-16 10:18 58880 —-a-w- c:\windows\system32\atl.dll
2009-07-14 05:43 . 2005-08-16 10:19 286208 —-a-w- c:\windows\system32\wmpdxm.dll
2009-07-03 17:09 . 2005-08-16 10:18 915456 —-a-w- c:\windows\system32\wininet.dll
2009-06-25 08:25 . 2005-08-16 10:18 54272 —-a-w- c:\windows\system32\wdigest.dll
2009-06-25 08:25 . 2005-08-16 10:18 56832 —-a-w- c:\windows\system32\secur32.dll
2009-06-25 08:25 . 2005-08-16 10:18 147456 —-a-w- c:\windows\system32\schannel.dll
2009-06-25 08:25 . 2005-08-16 10:18 136192 —-a-w- c:\windows\system32\msv1_0.dll
2009-06-25 08:25 . 2005-08-16 10:18 730112 —-a-w- c:\windows\system32\lsasrv.dll
2009-06-25 08:25 . 2005-08-16 10:18 301568 —-a-w- c:\windows\system32\kerberos.dll
2009-06-24 11:18 . 2005-08-16 10:18 92928 —-a-w- c:\windows\system32\drivers\ksecdd.sys
2009-06-22 07:12 . 2009-06-22 07:12 25 —-a-w- C:\popcinfot.dat
2009-06-19 08:45 . 2005-08-16 10:18 344064 —-a-w- c:\windows\system32\hnetcfg.dll
2009-06-19 08:41 . 2005-08-16 10:18 714752 —-a-w- c:\windows\system32\ntdll.dll
2009-06-17 16:56 . 2008-12-19 05:43 37392 —-a-w- c:\windows\system32\drivers\LMouFilt.Sys
2009-06-17 16:56 . 2008-12-19 05:43 35472 —-a-w- c:\windows\system32\drivers\LHidFilt.Sys
2009-06-17 16:55 . 2009-06-17 16:55 10384 —-a-w- c:\windows\system32\drivers\LHidEqd.sys
2009-06-17 16:55 . 2009-06-17 16:55 40720 —-a-w- c:\windows\system32\drivers\LEqdUsb.sys
2009-06-17 16:55 . 2008-12-19 05:42 55824 —-a-w- c:\windows\KHALMNPR.Exe
2009-06-16 14:36 . 2005-08-16 10:18 119808 —-a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:36 . 2005-08-16 10:18 81920 —-a-w- c:\windows\system32\fontsub.dll
2009-06-14 23:21 . 2006-12-10 18:45 93176 —-a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-12 12:31 . 2005-08-16 10:18 80896 —-a-w- c:\windows\system32\tlntsess.exe
2009-06-12 12:31 . 2005-08-16 10:18 76288 —-a-w- c:\windows\system32\telnet.exe
2009-06-10 15:19 . 2005-08-16 10:37 2066432 —-a-w- c:\windows\system32\mstscax.dll
2009-06-10 14:13 . 2005-08-16 10:18 84992 ——w- c:\windows\system32\avifil32.dll
2009-04-29 21:31 . 2009-06-21 14:41 1885896 —-a-w- c:\program files\PlantsVsZombies.exe
2009-04-29 21:31 . 2009-06-21 14:41 3008753 —-a-w- c:\program files\PlantsVsZombies.dat
2009-04-29 21:31 . 2009-06-21 14:41 24 —-a-w- c:\program files\drm.xml.sig
2009-04-29 21:31 . 2009-06-21 14:41 1009 —-a-w- c:\program files\drm.xml
2009-04-20 21:25 . 2009-06-21 14:41 25020446 —-a-w- c:\program files\main.pak
2009-02-18 20:21 . 2009-06-21 14:41 9683 —-a-w- c:\program files\eula.txt
2009-02-18 20:21 . 2009-06-21 14:41 6436 —-a-w- c:\program files\Install_props.xml
2008-12-08 22:24 . 2009-06-21 14:41 92216 —-a-w- c:\program files\bass.dll
2008-05-16 23:17 . 2009-03-02 21:58 13542299 —-a-w- c:\program files\Chicken Invaders 3 - Revenge of the Yolk v3.41.rar
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-04-28 61440]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-09-18 13574144]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-09-18 86016]
"SigmatelSysTrayApp"="stsystra.exe" - c:\windows\stsystra.exe [2006-08-15 282624]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2008-09-18 1657376]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2009-06-17 55824]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"WUAppSetup"="c:\program files\Common Files\logishrd\WUApp32.exe" [2008-12-17 443664]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-9-8 813584]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2009-07-20 18:28 72208 —-a-w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0autocheck smrgdf c:\documents and settings\This Guy\Application Data\iolo\\0OODBS

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]
@="FSFilter Activity Monitor"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ctfmon.exe"=c:\windows\system32\ctfmon.exe
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" -start
"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"ehTray"=c:\windows\ehome\ehtray.exe
"DMXLauncher"="c:\program files\Roxio\CinePlayer\DMXLauncher.exe"
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe"
"NvMediaCenter"=RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
"nwiz"=nwiz.exe /install
"SMSystemAnalyzer"="c:\program files\iolo\System Mechanic Professional 7\SMSystemAnalyzer.exe"
"Kernel and Hardware Abstraction Layer"=KHALMNPR.EXE
"NvCplDaemon"=RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\WINDOWS\\system32\\dxdiag.exe"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"51270:TCP"= 51270:TCP:vuze
"51270:UDP"= 51270:UDP:vuze1
"67:UDP"= 67:UDP:DHCP Discovery Service
"13745:TCP"= 13745:TCP:BitComet 13745 TCP
"13745:UDP"= 13745:UDP:BitComet 13745 UDP
"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundRouterRequest"= 1 (0x1)
"AllowOutboundDestinationUnreachable"= 1 (0x1)

R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360\0305020.00A\SymEFA.sys [8/21/2009 7:20 AM 310320]
R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\N360\0305020.00A\BHDrvx86.sys [8/21/2009 7:20 AM 259632]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\N360\0305020.00A\cchpx86.sys [8/21/2009 7:20 AM 482432]
R1 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090904.002\IDSXpx86.sys [9/5/2009 1:26 PM 276344]
R2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [9/8/2009 1:48 AM 10384]
R2 libusbd;LibUsb-Win32 - Daemon, Version 0.1.10.1;system32\libusbd-nt.exe –> system32\libusbd-nt.exe [?]
R2 N360;Norton 360;c:\program files\Norton 360\Engine\3.5.2.10\ccSvcHst.exe [8/21/2009 7:20 AM 117640]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [8/27/2009 7:12 PM 102448]
R3 LEqdUsb;Logitech SetPoint Unifying KMDF USB Filter;c:\windows\system32\drivers\LEqdUsb.sys [6/17/2009 10:55 AM 40720]
R3 LHidEqd;Logitech SetPoint Unifying KMDF HID Filter;c:\windows\system32\drivers\LHidEqd.sys [6/17/2009 10:55 AM 10384]
R3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.10.1;c:\windows\system32\drivers\libusb0.sys [4/1/2009 12:13 PM 33792]
R3 rt2870;Linksys 802.11n USB Wireless LAN Card Driver;c:\windows\system32\drivers\rt2870.sys [12/14/2007 6:04 PM 551680]
S2 Roxio Upnp Server 10;Roxio Upnp Server 10;c:\program files\Roxio\Digital Home 10\RoxioUpnpService10.exe [8/24/2007 4:53 PM 362992]
S2 RoxWatch10;Roxio Hard Drive Watcher 10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatch10.exe [8/24/2007 4:52 PM 166384]
S3 cpuz129;cpuz129;\??\c:\program files\PC Wizard 2008\pcwiz32.sys –> c:\program files\PC Wizard 2008\pcwiz32.sys [?]
S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [8/21/2008 11:49 PM 18688]
S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [8/21/2008 11:49 PM 8320]
S3 motport;Motorola USB Diagnostic Port;c:\windows\system32\drivers\motport.sys [6/18/2007 8:18 PM 23680]
S3 Roxio UPnP Renderer 10;Roxio UPnP Renderer 10;c:\program files\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe [8/24/2007 4:53 PM 72176]
S3 RoxMediaDB10;RoxMediaDB10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe [8/24/2007 4:52 PM 1083888]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [5/6/2008 4:06 PM 11520]
S4 RoxLiveShare10;LiveShare P2P Server 10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe [8/24/2007 4:52 PM 309744]
S4 SessionLauncher;SessionLauncher; [x]
S4 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\system32\TUProgSt.exe [6/9/2009 9:57 AM 604488]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder
.
.
——- Supplementary Scan ——-
.
uStart Page = about:blank
DPF: {E5ABEB00-B357-4884-9949-77B2C71A7EE3} - hxxp://www.intel.com/design/motherbd/boardid/BoardID.cab
.
.
——- File Associations ——-
.
JSEFile=NOTEPAD.EXE %1
VBEFile=NOTEPAD.EXE %1
VBSFile=NOTEPAD.EXE %1
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-08 02:18
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\N360]
"ImagePath"="\"c:\program files\Norton 360\Engine\3.5.2.10\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files\Norton 360\Engine\3.5.2.10\diMaster.dll\" /prefetch:1"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-3562891378-3382784536-2106522743-1006\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_USERS\S-1-5-21-3562891378-3382784536-2106522743-1006\Software\SecuROM\License information*]
"datasecu"=hex:6d,09,31,83,80,14,3d,cd,36,92,33,0d,e4,7d,69,d7,9d,84,30,cb,2c,
02,63,e5,5b,bc,50,a8,ce,27,cf,41,2b,da,cf,51,38,c0,10,9f,d7,c8,e8,60,4d,82,\
"rkeysecu"=hex:cb,bd,f2,61,5a,4e,c6,95,f2,29,8b,82,ba,6b,3d,44

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG11.00.00.01WORKSTATION"="A2C8E5DB6AA25D8D864029F078C11E11C4E4F35159587378BDB402A3044401218BC3E26005E
F56EBD0E8651EAC4A040DC3844D5D0DD2FA6899D45A78BF33BA8335D225188CECD300B1AA4134CE0D
382E33B83EB3B27C59298AA0680A44D81E052DEC65F2CA611F8FF4C49A39726AB51C3BA869094FEED
F6336CAB25BA1A8F171B3EE31687AB992A618DB25B1A1688D4237E14795D5E8F483F56996F659B791
D63F95EB74CB85A0144E7966ACD72F67D1B557A317B2CB94BA5377C4EAE2C16BFEBC9E127BECC74CF
EBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6
A0AC4980AC79335D575E7D6A3B9808A6171C11EC38DE3D8EDD5E5BE2F6E66753ED658FEE39D999D83
362611C5FADE0046DCF4019816357A7EBF91C90A3467A382585EBEF9F83B42B1B4531C8E7C08EE211
98564B284BB5B6105CD4C8B24DC373B9752C50BA9B67066D592B4E6192D0A3BF378AC695F9F109B9A
B529CBA8610CB72FB15E4A95DA434EE6D78D0FA350DAFDA2908A2A57C8ACD882B66B1E69693CE4B47
BF860524F34297B994FBD8DD3FB5F5CBD179A6018EF1CD0438B5D2C7914BF36A9691D6746E011359D
17C106AF6265C633DE8DE5D232810C142D6908663D6CF58D9E61B714305C249D583AC57D6B90B17F4
1585087F690BD45449A4637648756B1D6BC567B2A93B6D95C72EC8176934F1F5A3451C70EFAA128F4
487134D3D3262C807BBC3150AC40A6281068501F23B64133F40DB56BA14B1EB84A7EE7B15845D1827
58975487DBCB5AEF9CF7F6593DC0F09609A9260C1E50B449E3F3AB739FE01A3B68196E48B1BF72D2C
D2F696184BE085DA88D67ED51ED875513421A40EB58B3B9ADA2753429D7F3F1E6DE5F1714FAA9C99A
B33628EC70D7717E9F19A984109D99DFB18F7ADD6CFB152BDC77C72172F5154E6BC2CCE29D6B68627
58D9DB8B96058A6E7780998B6FA8BD124DE85158A6100A8A9D12DDB23DD8A6FCE6F528B6ADE76A18B
7C975C55B5A68654D7250E8AB64B8185BB6030921EAACA5ECD3E369BCBF8E386FE1FDCC944BA67AF3
B44DC9C94BE253C6C42EE5EEEA18E77499DA22B2E68716675DC83FB1523089DF33D0751EBA4522BE4
F25BE067CA46941771F1D9E251C4DE6BCF6A3567BB6F288135471C814C3FD7B7536B55708473D001F
D764D99444CC2FDBFE52450689800F50F0AD2F00712EA8E0C495BCB338B6FE24AB78ED555E90E6034
F6DB380C72767AF870B228AC68AE26875479894077D32FA3F00D6E1EF3DE587B58D15D136002C8DD5
05A67185014CCF51E96911415066C19131791BA337540A575604FE9B83F31F0B44DC3A64F2E694AEE
FE1FA13335300040E4BC4CE7390787EE47F202C6EB16A959F22A3CDC3672BABEE33F5A98B0AB6FD00
D447742342D3D1A27025149EBEEBF"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(920)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2009-09-08 2:19
ComboFix-quarantined-files.txt 2009-09-08 08:19

Pre-Run: 61,547,462,656 bytes free
Post-Run: 61,576,085,504 bytes free

318 — E O F — 2009-09-01 09:01

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:25:03 AM, on 9/8/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\system32\libusbd-nt.exe
C:\Program Files\Norton 360\Engine\3.5.2.10\ccSvcHst.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Norton 360\Engine\3.5.2.10\ccSvcHst.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\uTorrent\uTorrent.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client;=dell-usuk&channel;=us&ibd;=2061210
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360\Engine\3.5.2.10\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360\Engine\3.5.2.10\IPSBHO.DLL
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\3.5.2.10\coIEPlg.dll
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKUS\S-1-5-18\..\RunOnce: [WUAppSetup] C:\Program Files\Common Files\logishrd\WUApp32.exe -v 0x046d -p 0x0990 -f video -m logitech -d 11.90.1262.0 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [WUAppSetup] C:\Program Files\Common Files\logishrd\WUApp32.exe -v 0x046d -p 0x0990 -f video -m logitech -d 11.90.1262.0 (User 'Default user')
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownlo…iaSmartScan.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {E5ABEB00-B357-4884-9949-77B2C71A7EE3} (BoardCtl Class) - http://www.intel.com/design/motherbd/boardid/BoardID.cab
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton 360\Engine\3.5.2.10\coIEPlg.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: LibUsb-Win32 - Daemon, Version 0.1.10.1 (libusbd) - http://libusb-win32.sourceforge.net - C:\WINDOWS\system32\libusbd-nt.exe
O23 - Service: Norton 360 (N360) - Symantec Corporation - C:\Program Files\Norton 360\Engine\3.5.2.10\ccSvcHst.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: O&O; Defrag - O&O; Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: Roxio UPnP Renderer 10 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe
O23 - Service: Roxio Upnp Server 10 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 10\RoxioUpnpService10.exe
O23 - Service: RoxMediaDB10 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe
O23 - Service: Roxio Hard Drive Watcher 10 (RoxWatch10) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatch10.exe

–
End of file - 6076 bytes

Computer was running the same as usual. After combo fix IE has a very bad delay to it. Also, should i set IE as my default browser again? Going to reboot now, if IE doesn't go back to normal I will repost immediately.

LDTate

Post #6September 8, 2009, 8:48 PM UTC

Yes you can set IE as your default browser

Copy/paste the text in the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text.

File::

Folder::
c:\program files\WildTangent
c:\program files\WildTangent Games
c:\documents and settings\All Users\Application Data\WildTangent

Driver::

Registry::

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:
1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]

Drag CFScript.txt into ComboFix.exe

Then post the results log and a new HijackThis log.

Also please describe how your computer behaves at the moment.

regulate3210

Post #7September 14, 2009, 6:16 PM UTC

ComboFix 09-09-14.01 - This Guy 09/14/2009 10:58.3.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2942.2409 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\This Guy\Desktop\cfscript.txt
AV: Norton 360 *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton 360 *enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
.

((((((((((((((((((((((((( Files Created from 2009-08-14 to 2009-09-14 )))))))))))))))))))))))))))))))
.

2009-09-14 14:33 . 2009-09-14 14:33 ——– d—–w- c:\program files\CZero
2009-09-14 09:41 . 2009-09-14 09:41 ——– d—–w- c:\documents and settings\This Guy\Application Data\J River
2009-09-12 14:59 . 2009-09-12 15:00 ——– d—–w- c:\windows\system32\Adobe
2009-09-09 23:22 . 2009-06-21 21:44 153088 ——w- c:\windows\system32\dllcache\triedit.dll
2009-09-08 07:49 . 2009-09-08 07:49 ——– d—–w- c:\documents and settings\This Guy\Application Data\Logitech
2009-09-08 07:48 . 2009-09-08 07:48 ——– d—–w- c:\documents and settings\This Guy\Application Data\Leadertech
2009-09-08 07:48 . 2009-06-17 16:55 10384 —-a-w- c:\windows\system32\drivers\LBeepKE.sys
2009-09-08 07:47 . 2009-07-20 18:25 301656 —-a-w- c:\windows\system32\BtCoreIf.dll
2009-09-08 07:47 . 2009-07-20 18:26 84496 —-a-w- c:\windows\system32\KemXML.dll
2009-09-08 07:47 . 2009-07-20 18:26 117264 —-a-w- c:\windows\system32\KemWnd.dll
2009-09-08 07:47 . 2009-07-20 18:26 145936 —-a-w- c:\windows\system32\KemUtil.dll
2009-09-08 07:47 . 2009-07-20 18:26 170512 —-a-w- c:\windows\system32\kemutb.dll
2009-09-08 07:47 . 2009-09-08 07:47 ——– d—–w- c:\documents and settings\All Users\Application Data\Logitech
2009-09-08 07:47 . 2009-09-08 07:47 ——– d—–w- c:\program files\Logitech
2009-09-07 05:26 . 2009-08-03 19:36 38160 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-07 05:26 . 2009-09-07 05:26 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-09-07 05:26 . 2009-08-03 19:36 19096 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-09-03 13:48 . 2008-10-16 20:06 208744 —-a-w- c:\windows\system32\muweb.dll
2009-09-03 09:46 . 2009-09-03 09:46 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\Symantec
2009-09-03 06:04 . 2009-09-03 06:04 ——– d—–w- c:\program files\ERUNT
2009-09-03 05:39 . 2009-09-03 05:39 ——– d—–w- c:\program files\Trend Micro
2009-09-02 19:27 . 2009-09-02 19:27 ——– d—–w- c:\windows\nview
2009-09-02 19:27 . 2008-09-18 05:55 453152 —-a-w- c:\windows\system32\nvuninst.exe
2009-09-02 19:27 . 2008-09-18 05:55 453152 —-a-w- c:\windows\system32\nvudisp.exe
2009-09-01 19:40 . 2009-09-02 19:45 ——– d—–w- c:\program files\ChickenInvadersROTYXmas
2009-09-01 14:23 . 2009-09-01 14:50 ——– d—–w- c:\program files\Chicken Invaders 2
2009-09-01 02:52 . 2009-06-25 08:25 54272 ——w- c:\windows\system32\dllcache\wdigest.dll
2009-09-01 02:52 . 2009-06-25 08:25 301568 ——w- c:\windows\system32\dllcache\kerberos.dll
2009-09-01 02:52 . 2009-06-25 08:25 136192 ——w- c:\windows\system32\dllcache\msv1_0.dll
2009-09-01 02:52 . 2009-06-24 11:18 92928 ——w- c:\windows\system32\dllcache\ksecdd.sys
2009-08-30 15:54 . 2009-08-30 15:54 ——– d—–w- c:\program files\LibUSB-Win32-0.1.10.1
2009-08-30 15:54 . 2005-03-10 02:50 19456 —-a-w- c:\windows\system32\libusbd-9x.exe
2009-08-30 15:54 . 2005-03-10 02:50 18944 —-a-w- c:\windows\system32\libusbd-nt.exe
2009-08-29 01:32 . 2008-04-13 23:12 53760 —-a-w- c:\windows\system32\vfwwdm32.dll
2009-08-29 01:32 . 2008-04-13 23:12 53760 —-a-w- c:\windows\system32\dllcache\vfwwdm32.dll
2009-08-28 11:37 . 2009-08-28 11:37 0 —-a-w- c:\windows\ativpsrm.bin
2009-08-28 11:36 . 2009-08-28 11:36 ——– d—–w- c:\documents and settings\All Users\Application Data\ATI
2009-08-28 10:36 . 2009-08-28 10:36 ——– d—–w- c:\program files\Common Files\ATI Technologies
2009-08-28 10:34 . 2009-04-28 03:20 593920 ——w- c:\windows\system32\ati2sgag.exe
2009-08-28 10:20 . 2009-04-28 03:58 307200 —-a-w- c:\windows\system32\atiiiexx.dll
2009-08-28 10:20 . 2009-04-23 21:29 189051 —-a-w- c:\windows\system32\atiicdxx.dat
2009-08-28 10:20 . 2006-12-17 02:30 3107788 —-a-r- c:\windows\system32\ativvaxx.dat
2009-08-25 04:55 . 2009-08-25 04:55 ——– d—–w- c:\documents and settings\This Guy\Application Data\iWin
2009-08-25 04:54 . 2009-08-25 04:54 ——– d—–w- c:\program files\iWin.com
2009-08-23 07:04 . 2009-08-23 12:33 ——– d—–w- c:\program files\Xpadder
2009-08-23 03:20 . 2008-12-17 06:01 6364440 —-a-w- c:\windows\system32\drivers\lvuvc.sys
2009-08-23 03:20 . 2008-12-17 06:01 41752 —-a-w- c:\windows\system32\drivers\LVUSBSta.sys
2009-08-23 03:20 . 2008-12-17 06:01 432664 —-a-w- c:\windows\system32\LVUI2RC.dll
2009-08-23 03:20 . 2008-12-17 06:00 494104 —-a-w- c:\windows\system32\LVUI2.dll
2009-08-23 03:20 . 2008-12-17 05:55 195096 —-a-w- c:\windows\system32\lvci11901262.dll
2009-08-23 03:20 . 2008-12-17 05:55 416280 —-a-w- c:\windows\system32\lvcodec2.dll
2009-08-23 03:20 . 2008-12-17 06:00 768024 —-a-w- c:\windows\system32\drivers\lvrs.sys
2009-08-23 03:20 . 2008-12-17 05:37 29562 —-a-w- c:\windows\system32\Repository.reg
2009-08-23 03:20 . 2008-12-17 06:02 23832 —-a-w- c:\windows\system32\drivers\lvuvcflt.sys
2009-08-22 06:38 . 2009-08-22 06:38 ——– d—–w- c:\documents and settings\This Guy\Local Settings\Application Data\Thinstall
2009-08-22 06:38 . 2009-08-22 06:38 ——– d—–w- c:\documents and settings\This Guy\Application Data\Thinstall
2009-08-21 14:47 . 2009-08-21 14:59 1140850688 –sha-w- C:\NRTPage.sys
2009-08-21 13:20 . 2009-08-21 13:20 36400 —-a-r- c:\windows\system32\drivers\SymIM.sys
2009-08-21 13:20 . 2009-08-21 13:20 60808 —-a-w- c:\windows\system32\S32EVNT1.DLL
2009-08-21 13:20 . 2009-08-21 13:20 124976 —-a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2009-08-21 13:20 . 2009-08-21 13:20 ——– d—–w- c:\program files\Symantec
2009-08-21 13:19 . 2009-09-09 16:03 ——– d—–w- c:\windows\system32\drivers\N360
2009-08-21 13:19 . 2009-08-21 13:20 ——– d—–w- c:\program files\Norton 360
2009-08-21 13:19 . 2009-08-21 13:19 ——– d—–w- c:\program files\Windows Sidebar
2009-08-21 13:19 . 2009-08-21 13:19 ——– d—–w- c:\program files\NortonInstaller
2009-08-21 11:18 . 2009-08-23 12:09 ——– d—–w- c:\documents and settings\This Guy\Local Settings\Application Data\RcIncidents
2009-08-19 17:02 . 2009-08-19 17:02 ——– d—–w- c:\documents and settings\LocalService\Local Settings\Application Data\Downloaded Installations
2009-08-18 06:44 . 2009-08-18 06:44 ——– d—–w- c:\documents and settings\All Users\Application Data\NVIDIA Corporation
2009-08-18 06:44 . 2009-08-18 06:44 ——– d—–w- c:\program files\NVIDIA Corporation
2009-08-18 06:44 . 2006-03-29 14:51 60416 —-a-w- c:\windows\system32\DSETUP.dll
2009-08-18 06:44 . 2006-03-29 14:50 671744 —-a-w- c:\windows\system32\DolbyHph.dll
2009-08-18 06:44 . 2006-03-29 14:49 9856 —-a-w- c:\windows\system32\drivers\pfc.sys
2009-08-17 05:59 . 2009-08-17 06:00 ——– d—–w- c:\program files\Program
2009-08-17 01:27 . 2009-07-10 13:27 1315328 ——w- c:\windows\system32\dllcache\msoe.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-14 15:41 . 2009-06-10 02:57 ——– d—–w- c:\documents and settings\This Guy\Application Data\uTorrent
2009-09-14 09:43 . 2009-01-19 21:20 ——– d—–w- c:\program files\J River
2009-09-14 06:06 . 2009-07-07 17:03 ——– d—–w- c:\documents and settings\This Guy\Application Data\Any DVD Converter Professional
2009-09-13 11:07 . 2006-12-10 18:45 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-09-12 20:30 . 2009-03-02 22:06 ——– d—–w- c:\documents and settings\All Users\Application Data\InterAction studios
2009-09-10 09:02 . 2009-04-10 05:25 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-09-10 04:54 . 2009-02-12 18:01 10 —-a-w- c:\windows\popcinfo.dat
2009-09-08 07:48 . 2008-12-18 05:04 ——– d—–w- c:\program files\Common Files\Logishrd
2009-09-08 07:48 . 2008-12-18 05:05 ——– d—–w- c:\documents and settings\All Users\Application Data\LogiShrd
2009-09-08 07:47 . 2009-09-08 07:47 0 —ha-w- c:\windows\system32\drivers\Msft_Kernel_LHidEqd_01005.Wdf
2009-09-08 07:47 . 2009-09-08 07:47 0 —ha-w- c:\windows\system32\drivers\Msft_Kernel_LEqdUsb_01005.Wdf
2009-09-08 07:47 . 2006-12-10 18:24 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-09-03 08:11 . 2009-05-22 19:11 10748 –sha-w- c:\windows\system32\drivers\fidbox2.idx
2009-09-03 08:11 . 2009-05-22 19:11 103200 –sha-w- c:\windows\system32\drivers\fidbox2.dat
2009-09-03 08:11 . 2009-05-22 19:11 49556 –sha-w- c:\windows\system32\drivers\fidbox.idx
2009-09-03 08:11 . 2009-05-22 19:11 3619872 –sha-w- c:\windows\system32\drivers\fidbox.dat
2009-09-03 08:09 . 2009-04-19 10:13 ——– d—–w- c:\program files\WebEx
2009-09-03 02:08 . 2009-05-22 19:00 ——– d—–w- c:\program files\Common Files\ParetoLogic
2009-08-30 03:16 . 2009-08-30 03:16 0 —ha-w- c:\windows\system32\drivers\Msft_Kernel_motport_01005.Wdf
2009-08-30 03:15 . 2009-08-30 03:15 0 —ha-w- c:\windows\system32\drivers\Msft_Kernel_motmodem_01005.Wdf
2009-08-30 03:14 . 2009-08-30 03:14 0 —ha-w- c:\windows\system32\drivers\Msft_Kernel_motccgpfl_01005.Wdf
2009-08-30 03:14 . 2009-08-30 03:14 0 —ha-w- c:\windows\system32\drivers\Msft_Kernel_motccgp_01005.Wdf
2009-08-29 04:21 . 2009-02-18 16:57 ——– d—–w- c:\documents and settings\All Users\Application Data\Roxio
2009-08-29 01:32 . 2009-08-29 01:32 0 —-a-w- c:\windows\system32\drivers\lvuvc.hs
2009-08-29 01:32 . 2009-08-29 01:32 0 —-a-w- c:\windows\system32\drivers\logiflt.iad
2009-08-28 12:32 . 2008-11-30 17:04 ——– d—–w- c:\program files\AMD
2009-08-28 11:36 . 2009-05-02 15:19 ——– d—–w- c:\documents and settings\This Guy\Application Data\ATI
2009-08-28 11:22 . 2009-05-02 15:15 ——– d—–w- c:\program files\ATI Technologies
2009-08-23 12:15 . 2009-04-14 09:19 ——– d—–w- c:\program files\iolo
2009-08-23 12:14 . 2009-04-14 09:16 ——– d—–w- c:\documents and settings\All Users\Application Data\iolo
2009-08-23 12:12 . 2009-04-13 07:34 ——– d—–w- c:\program files\Reflexive Arcade Games - Word
2009-08-23 12:12 . 2009-04-10 10:16 ——– d—–w- c:\program files\Reflexive Arcade Games - Shooter
2009-08-23 12:11 . 2009-04-10 10:38 ——– d—–w- c:\program files\Reflexive Arcade Games - Puzzle
2009-08-23 12:09 . 2009-04-11 05:10 ——– d—–w- c:\program files\Reflexive Arcade Games - Action
2009-08-21 13:31 . 2006-12-10 18:31 ——– d—–w- c:\program files\Common Files\Symantec Shared
2009-08-21 13:20 . 2009-08-21 13:20 806 —-a-w- c:\windows\system32\drivers\SYMEVENT.INF
2009-08-21 13:20 . 2009-08-21 13:20 7456 —-a-w- c:\windows\system32\drivers\SYMEVENT.CAT
2009-08-21 13:20 . 2008-01-29 19:01 26600 —-a-r- c:\windows\system32\drivers\GEARAspiWDM.sys
2009-08-21 13:20 . 2008-01-29 19:02 107368 —-a-r- c:\windows\system32\GEARAspi.dll
2009-08-21 13:19 . 2009-05-13 18:19 ——– d—–w- c:\documents and settings\All Users\Application Data\NortonInstaller
2009-08-17 03:31 . 2005-08-16 10:18 15360 ——w- c:\windows\system32\ctfmon.exe
2009-08-17 03:22 . 2009-01-04 03:58 ——– d-sh–w- c:\documents and settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357}
2009-08-05 09:01 . 2005-08-16 10:18 204800 —-a-w- c:\windows\system32\mswebdvd.dll
2009-08-05 01:02 . 2009-07-05 18:45 ——– d—–w- c:\documents and settings\This Guy\Application Data\Any Video Converter
2009-07-28 22:35 . 2009-07-26 00:35 ——– d—–w- c:\documents and settings\All Users\Application Data\NOS
2009-07-25 18:10 . 2009-07-25 18:10 ——– d—–w- c:\documents and settings\This Guy\Application Data\WinBatch
2009-07-25 01:26 . 2009-07-07 17:03 ——– d—–w- c:\program files\Any DVD Converter Professional
2009-07-24 23:41 . 2009-06-09 15:57 604488 —-a-w- c:\windows\system32\TUProgSt.exe
2009-07-21 18:05 . 2009-06-22 12:14 25 —-a-w- c:\windows\popcinfot.dat
2009-07-21 18:05 . 2009-06-21 14:41 74 —-a-w- c:\program files\updates.xml
2009-07-18 15:49 . 2009-02-18 17:20 ——– d—–w- c:\documents and settings\This Guy\Application Data\Roxio
2009-07-18 15:49 . 2008-12-15 04:22 ——– d—–w- c:\documents and settings\This Guy\Application Data\Azureus
2009-07-17 19:01 . 2005-08-16 10:18 58880 —-a-w- c:\windows\system32\atl.dll
2009-07-14 05:43 . 2005-08-16 10:19 286208 —-a-w- c:\windows\system32\wmpdxm.dll
2009-07-03 17:09 . 2005-08-16 10:18 915456 ——w- c:\windows\system32\wininet.dll
2009-06-25 08:25 . 2005-08-16 10:18 54272 —-a-w- c:\windows\system32\wdigest.dll
2009-06-25 08:25 . 2005-08-16 10:18 56832 —-a-w- c:\windows\system32\secur32.dll
2009-06-25 08:25 . 2005-08-16 10:18 147456 —-a-w- c:\windows\system32\schannel.dll
2009-06-25 08:25 . 2005-08-16 10:18 136192 —-a-w- c:\windows\system32\msv1_0.dll
2009-06-25 08:25 . 2005-08-16 10:18 730112 —-a-w- c:\windows\system32\lsasrv.dll
2009-06-25 08:25 . 2005-08-16 10:18 301568 —-a-w- c:\windows\system32\kerberos.dll
2009-06-24 11:18 . 2005-08-16 10:18 92928 —-a-w- c:\windows\system32\drivers\ksecdd.sys
2009-06-22 07:12 . 2009-06-22 07:12 25 —-a-w- C:\popcinfot.dat
2009-06-19 08:45 . 2005-08-16 10:18 344064 —-a-w- c:\windows\system32\hnetcfg.dll
2009-06-19 08:41 . 2005-08-16 10:18 714752 —-a-w- c:\windows\system32\ntdll.dll
2009-06-17 16:56 . 2008-12-19 05:43 37392 —-a-w- c:\windows\system32\drivers\LMouFilt.Sys
2009-06-17 16:56 . 2008-12-19 05:43 35472 —-a-w- c:\windows\system32\drivers\LHidFilt.Sys
2009-06-17 16:55 . 2009-06-17 16:55 10384 —-a-w- c:\windows\system32\drivers\LHidEqd.sys
2009-06-17 16:55 . 2009-06-17 16:55 40720 —-a-w- c:\windows\system32\drivers\LEqdUsb.sys
2009-06-17 16:55 . 2008-12-19 05:42 55824 —-a-w- c:\windows\KHALMNPR.Exe
2009-04-29 21:31 . 2009-06-21 14:41 1885896 —-a-w- c:\program files\PlantsVsZombies.exe
2009-04-29 21:31 . 2009-06-21 14:41 3008753 —-a-w- c:\program files\PlantsVsZombies.dat
2009-04-29 21:31 . 2009-06-21 14:41 24 —-a-w- c:\program files\drm.xml.sig
2009-04-29 21:31 . 2009-06-21 14:41 1009 —-a-w- c:\program files\drm.xml
2009-04-20 21:25 . 2009-06-21 14:41 25020446 —-a-w- c:\program files\main.pak
2009-02-18 20:21 . 2009-06-21 14:41 9683 —-a-w- c:\program files\eula.txt
2009-02-18 20:21 . 2009-06-21 14:41 6436 —-a-w- c:\program files\Install_props.xml
2008-12-08 22:24 . 2009-06-21 14:41 92216 —-a-w- c:\program files\bass.dll
2008-05-16 23:17 . 2009-03-02 21:58 13542299 —-a-w- c:\program files\Chicken Invaders 3 - Revenge of the Yolk v3.41.rar
.

((((((((((((((((((((((((((((( SnapShot@2009-09-08_08.18.14 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-09-14 16:18 . 2009-09-14 16:18 16384 c:\windows\Temp\Perflib_Perfdata_164.dat
+ 2009-09-08 22:44 . 2009-08-22 08:26 48688 c:\windows\system32\drivers\N360\0305020.00B\symndisv.sys
+ 2009-09-08 22:44 . 2009-08-22 08:26 36400 c:\windows\system32\drivers\N360\0305020.00B\symndis.sys
+ 2009-09-08 22:44 . 2009-08-22 08:26 33072 c:\windows\system32\drivers\N360\0305020.00B\symids.sys
+ 2009-09-08 22:44 . 2009-08-22 08:26 89904 c:\windows\system32\drivers\N360\0305020.00B\symfw.sys
+ 2009-09-08 22:44 . 2009-08-22 08:26 43696 c:\windows\system32\drivers\N360\0305020.00B\srtspx.sys
+ 2009-09-12 15:00 . 2009-09-12 15:00 87618 c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
+ 2009-07-31 13:26 . 2009-07-31 13:26 94208 c:\windows\system32\Adobe\Shockwave 11\SwMenu.dll
+ 2009-07-31 12:54 . 2009-07-31 12:54 79488 c:\windows\system32\Adobe\Shockwave 11\gtapi.dll
+ 2009-07-31 13:42 . 2009-07-31 13:42 67000 c:\windows\system32\Adobe\Director\SWDNLD.EXE
+ 2009-04-10 05:27 . 2009-09-10 09:01 35088 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\oisicon.exe
- 2009-04-10 05:27 . 2009-08-17 09:02 35088 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\oisicon.exe
+ 2009-04-10 05:27 . 2009-09-10 09:01 18704 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\mspicons.exe
- 2009-04-10 05:27 . 2009-08-17 09:02 18704 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\mspicons.exe
- 2009-04-10 05:27 . 2009-08-17 09:02 20240 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\cagicon.exe
+ 2009-04-10 05:27 . 2009-09-10 09:01 20240 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\cagicon.exe
- 2008-11-30 15:53 . 2009-05-25 14:03 77824 c:\windows\assembly\GAC\SonicMCEBurnEngine\0.9.0.0__17c52700e9a64fd0\SonicMCEBurnEngine.dll
+ 2009-09-10 09:10 . 2009-09-10 09:10 77824 c:\windows\assembly\GAC\SonicMCEBurnEngine\0.9.0.0__17c52700e9a64fd0\SonicMCEBurnEngine.dll
+ 2009-09-10 09:10 . 2009-09-10 09:10 45056 c:\windows\assembly\GAC\Microsoft.MediaCenter\6.0.3100.0__31bf3856ad364e35\Microsoft.MediaCenter.dll
- 2008-11-30 15:53 . 2009-05-25 14:02 45056 c:\windows\assembly\GAC\Microsoft.MediaCenter\6.0.3100.0__31bf3856ad364e35\Microsoft.MediaCenter.dll
+ 2009-09-10 09:10 . 2009-09-10 09:10 53248 c:\windows\assembly\GAC\ehiWUapi\6.0.3000.0__31bf3856ad364e35\ehiWUapi.dll
- 2008-11-30 15:53 . 2009-05-25 14:02 53248 c:\windows\assembly\GAC\ehiWUapi\6.0.3000.0__31bf3856ad364e35\ehiWUapi.dll
- 2008-11-30 15:53 . 2008-11-30 15:53 18944 c:\windows\assembly\GAC\ehiUserXp\6.0.3000.0__31bf3856ad364e35\ehiuserxp.dll
+ 2009-09-10 09:10 . 2009-09-10 09:10 18944 c:\windows\assembly\GAC\ehiUserXp\6.0.3000.0__31bf3856ad364e35\ehiuserxp.dll
- 2008-11-30 15:53 . 2009-05-25 14:02 73728 c:\windows\assembly\GAC\ehiExtens\6.0.3000.0__31bf3856ad364e35\ehiExtens.dll
+ 2009-09-10 09:10 . 2009-09-10 09:10 73728 c:\windows\assembly\GAC\ehiExtens\6.0.3000.0__31bf3856ad364e35\ehiExtens.dll
+ 2009-07-31 13:28 . 2009-07-31 13:28 9216 c:\windows\system32\Adobe\Shockwave 11\DynaPlayer.dll
- 2008-11-30 15:53 . 2009-05-25 14:02 8192 c:\windows\assembly\GAC\ehiExtCOM\6.0.3000.0__31bf3856ad364e35\ehiExtCOM.dll
+ 2009-09-10 09:10 . 2009-09-10 09:10 8192 c:\windows\assembly\GAC\ehiExtCOM\6.0.3000.0__31bf3856ad364e35\ehiExtCOM.dll
+ 2005-08-16 10:18 . 2009-06-22 06:44 726528 c:\windows\system32\jscript.dll
- 2005-08-16 10:18 . 2009-03-08 10:33 726528 c:\windows\system32\jscript.dll
+ 2009-09-08 22:44 . 2009-08-22 08:26 217136 c:\windows\system32\drivers\N360\0305020.00B\symtdi.sys
+ 2009-09-08 22:44 . 2009-08-22 08:26 310320 c:\windows\system32\drivers\N360\0305020.00B\SymEFA.sys
+ 2009-09-08 22:44 . 2009-08-22 08:26 308272 c:\windows\system32\drivers\N360\0305020.00B\srtsp.sys
+ 2009-09-08 22:44 . 2009-08-22 08:26 482432 c:\windows\system32\drivers\N360\0305020.00B\cchpx86.sys
+ 2009-09-08 22:44 . 2009-08-22 08:26 259632 c:\windows\system32\drivers\N360\0305020.00B\BHDrvx86.sys
+ 2008-05-09 10:53 . 2009-06-22 06:44 726528 c:\windows\system32\dllcache\jscript.dll
- 2008-05-09 10:53 . 2009-03-08 10:33 726528 c:\windows\system32\dllcache\jscript.dll
+ 2009-07-31 12:54 . 2009-07-31 12:54 132472 c:\windows\system32\Adobe\Shockwave 11\SYMCCHECKER.DLL
+ 2009-07-31 13:26 . 2009-07-31 13:26 114688 c:\windows\system32\Adobe\Shockwave 11\SwInit.exe
+ 2009-07-31 13:40 . 2009-07-31 13:40 468408 c:\windows\system32\Adobe\Shockwave 11\SwHelper_1151601.exe
+ 2009-07-31 13:28 . 2009-07-31 13:28 446464 c:\windows\system32\Adobe\Shockwave 11\Proj.dll
+ 2009-07-31 13:26 . 2009-07-31 13:26 372736 c:\windows\system32\Adobe\Shockwave 11\Plugin.dll
+ 2009-07-31 12:54 . 2009-07-31 12:54 714752 c:\windows\system32\Adobe\Shockwave 11\gi.dll
+ 2009-07-31 13:25 . 2009-07-31 13:25 614400 c:\windows\system32\Adobe\Shockwave 11\Control.dll
+ 2009-07-31 13:41 . 2009-07-31 13:41 206264 c:\windows\system32\Adobe\Director\SwDir.dll
+ 2009-07-31 13:27 . 2009-07-31 13:27 131072 c:\windows\system32\Adobe\Director\np32dsw.dll
+ 2009-04-10 05:27 . 2009-09-10 09:01 888080 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\wordicon.exe
- 2009-04-10 05:27 . 2009-08-17 09:02 888080 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\wordicon.exe
+ 2009-04-10 05:27 . 2009-09-10 09:01 272648 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pubs.exe
- 2009-04-10 05:27 . 2009-08-17 09:02 272648 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pubs.exe
+ 2009-04-10 05:27 . 2009-09-10 09:01 922384 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pptico.exe
- 2009-04-10 05:27 . 2009-08-17 09:02 922384 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pptico.exe
- 2009-04-10 05:27 . 2009-08-17 09:02 845584 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\outicon.exe
+ 2009-04-10 05:27 . 2009-09-10 09:01 845584 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\outicon.exe
+ 2009-04-10 05:27 . 2009-09-10 09:01 217864 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\misc.exe
- 2009-04-10 05:27 . 2009-08-17 09:02 217864 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\misc.exe
- 2009-04-10 05:27 . 2009-08-17 09:02 184080 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\joticon.exe
+ 2009-04-10 05:27 . 2009-09-10 09:01 184080 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\joticon.exe
+ 2009-04-10 05:27 . 2009-09-10 09:01 159504 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\inficon.exe
- 2009-04-10 05:27 . 2009-08-17 09:02 159504 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\inficon.exe
+ 2009-09-10 09:00 . 2008-07-08 13:02 382840 c:\windows\ie8updates\KB971961-IE8\spuninst\updspapi.dll
+ 2009-09-10 09:00 . 2008-07-08 13:02 231288 c:\windows\ie8updates\KB971961-IE8\spuninst\spuninst.exe
+ 2009-09-10 09:00 . 2009-03-08 10:33 726528 c:\windows\ie8updates\KB971961-IE8\jscript.dll
+ 2005-08-16 10:37 . 2009-08-18 16:55 179712 c:\windows\ehome\ehkeyctl.dll
- 2008-11-30 15:53 . 2009-05-25 14:02 389120 c:\windows\assembly\GAC\ehRecObj\6.0.3000.0__31bf3856ad364e35\ehRecObj.dll
+ 2009-09-10 09:10 . 2009-09-10 09:10 389120 c:\windows\assembly\GAC\ehRecObj\6.0.3000.0__31bf3856ad364e35\ehRecObj.dll
+ 2009-09-10 09:10 . 2009-09-10 09:10 122880 c:\windows\assembly\GAC\ehiwmp\6.0.3000.0__31bf3856ad364e35\ehiwmp.dll
- 2008-11-30 15:53 . 2009-05-25 14:02 122880 c:\windows\assembly\GAC\ehiwmp\6.0.3000.0__31bf3856ad364e35\ehiwmp.dll
+ 2009-09-10 09:10 . 2009-09-10 09:10 278528 c:\windows\assembly\GAC\ehiVidCtl\6.0.3000.0__31bf3856ad364e35\ehiVidCtl.dll
- 2008-11-30 15:53 . 2009-05-25 14:02 278528 c:\windows\assembly\GAC\ehiVidCtl\6.0.3000.0__31bf3856ad364e35\ehiVidCtl.dll
+ 2009-09-10 09:10 . 2009-09-10 09:10 389120 c:\windows\assembly\GAC\ehiProxy\6.0.3000.0__31bf3856ad364e35\ehiProxy.dll
- 2008-11-30 15:53 . 2009-05-25 14:02 389120 c:\windows\assembly\GAC\ehiProxy\6.0.3000.0__31bf3856ad364e35\ehiProxy.dll
- 2008-12-18 14:22 . 2009-05-25 14:02 204800 c:\windows\assembly\GAC\ehiPlay\6.0.3000.0__31bf3856ad364e35\ehiplay.dll
+ 2009-09-10 09:10 . 2009-09-10 09:10 204800 c:\windows\assembly\GAC\ehiPlay\6.0.3000.0__31bf3856ad364e35\ehiPlay.dll
+ 2009-09-10 09:10 . 2009-09-10 09:10 167936 c:\windows\assembly\GAC\ehiMsgr\6.0.3000.0__31bf3856ad364e35\ehiMsgr.dll
- 2008-11-30 15:53 . 2009-05-25 14:02 167936 c:\windows\assembly\GAC\ehiMsgr\6.0.3000.0__31bf3856ad364e35\ehiMsgr.dll
+ 2009-09-10 09:10 . 2009-09-10 09:10 110592 c:\windows\assembly\GAC\ehExtCOM\6.0.3000.0__31bf3856ad364e35\ehExtCOM.dll
- 2008-11-30 15:53 . 2009-05-25 14:02 110592 c:\windows\assembly\GAC\ehExtCOM\6.0.3000.0__31bf3856ad364e35\ehExtCOM.dll
+ 2009-09-10 09:10 . 2009-09-10 09:10 126976 c:\windows\assembly\GAC\ehepgdat\6.0.3000.0__31bf3856ad364e35\ehepgdat.dll
- 2008-11-30 15:53 . 2009-05-25 14:02 126976 c:\windows\assembly\GAC\ehepgdat\6.0.3000.0__31bf3856ad364e35\ehepgdat.dll
- 2008-12-18 14:22 . 2009-05-25 14:02 868352 c:\windows\assembly\GAC\ehepg\6.0.3000.0__31bf3856ad364e35\ehepg.dll
+ 2009-09-10 09:10 . 2009-09-10 09:10 868352 c:\windows\assembly\GAC\ehepg\6.0.3000.0__31bf3856ad364e35\ehepg.dll
- 2008-11-30 15:53 . 2009-05-25 14:02 192512 c:\windows\assembly\GAC\ehcommon\6.0.3000.0__31bf3856ad364e35\ehcommon.dll
+ 2009-09-10 09:10 . 2009-09-10 09:10 192512 c:\windows\assembly\GAC\ehcommon\6.0.3000.0__31bf3856ad364e35\ehcommon.dll
- 2008-11-30 15:53 . 2009-05-25 14:02 102400 c:\windows\assembly\GAC\ehCIR\6.0.3000.0__31bf3856ad364e35\ehCIR.dll
+ 2009-09-10 09:10 . 2009-09-10 09:10 102400 c:\windows\assembly\GAC\ehCIR\6.0.3000.0__31bf3856ad364e35\ehCIR.dll
+ 2009-09-10 09:10 . 2009-09-10 09:10 117248 c:\windows\assembly\GAC\BDATunePIA\6.0.3000.0__31bf3856ad364e35\bdatunepia.dll
- 2008-11-30 15:53 . 2008-11-30 15:53 117248 c:\windows\assembly\GAC\BDATunePIA\6.0.3000.0__31bf3856ad364e35\bdatunepia.dll
+ 2005-08-16 10:19 . 2009-05-20 10:56 2458112 c:\windows\system32\WMVCore.dll
- 2005-08-16 10:19 . 2008-06-18 12:03 2458112 c:\windows\system32\WMVCore.dll
- 2008-11-30 12:42 . 2008-06-18 12:03 2458112 c:\windows\system32\dllcache\WMVCore.dll
+ 2008-11-30 12:42 . 2009-05-20 10:56 2458112 c:\windows\system32\dllcache\WMVCore.dll
+ 2009-07-31 13:00 . 2009-07-31 13:00 1011712 c:\windows\system32\Adobe\Shockwave 11\iml32.dll
+ 2009-07-31 12:54 . 2009-07-31 12:54 1886320 c:\windows\system32\Adobe\Shockwave 11\gt.exe
+ 2009-07-31 13:04 . 2009-07-31 13:04 1798144 c:\windows\system32\Adobe\Shockwave 11\dirapi.dll
+ 2009-08-18 18:56 . 2009-08-18 18:56 5020672 c:\windows\Installer\10629d9.msp
- 2009-04-10 05:27 . 2009-08-17 09:02 1172240 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\xlicons.exe
+ 2009-04-10 05:27 . 2009-09-10 09:01 1172240 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\xlicons.exe
- 2009-04-10 05:27 . 2009-08-17 09:02 1165584 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\accicons.exe
+ 2009-04-10 05:27 . 2009-09-10 09:01 1165584 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\accicons.exe
- 2008-12-18 14:22 . 2009-05-25 14:02 1863680 c:\windows\assembly\GAC\EhCM\6.0.3000.0__31bf3856ad364e35\ehcm.dll
+ 2009-09-10 09:10 . 2009-09-10 09:10 1863680 c:\windows\assembly\GAC\EhCM\6.0.3000.0__31bf3856ad364e35\EhCM.dll
+ 2008-11-30 12:55 . 2009-08-28 21:38 24689600 c:\windows\system32\MRT.exe
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-04-28 61440]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-09-18 13574144]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-09-18 86016]
"SigmatelSysTrayApp"="stsystra.exe" - c:\windows\stsystra.exe [2006-08-15 282624]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2008-09-18 1657376]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2009-06-17 55824]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"WUAppSetup"="c:\program files\Common Files\logishrd\WUApp32.exe" [2008-12-17 443664]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-9-8 813584]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2009-07-20 18:28 72208 —-a-w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0autocheck smrgdf c:\documents and settings\This Guy\Application Data\iolo\\0OODBS

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]
@="FSFilter Activity Monitor"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ctfmon.exe"=c:\windows\system32\ctfmon.exe
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" -start
"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"ehTray"=c:\windows\ehome\ehtray.exe
"DMXLauncher"="c:\program files\Roxio\CinePlayer\DMXLauncher.exe"
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe"
"NvMediaCenter"=RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
"nwiz"=nwiz.exe /install
"SMSystemAnalyzer"="c:\program files\iolo\System Mechanic Professional 7\SMSystemAnalyzer.exe"
"Kernel and Hardware Abstraction Layer"=KHALMNPR.EXE
"NvCplDaemon"=RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\WINDOWS\\system32\\dxdiag.exe"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"51270:TCP"= 51270:TCP:vuze
"51270:UDP"= 51270:UDP:vuze1
"67:UDP"= 67:UDP:DHCP Discovery Service
"13745:TCP"= 13745:TCP:BitComet 13745 TCP
"13745:UDP"= 13745:UDP:BitComet 13745 UDP
"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundRouterRequest"= 1 (0x1)
"AllowOutboundDestinationUnreachable"= 1 (0x1)

R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360\0305020.00B\SymEFA.sys [9/8/2009 4:44 PM 310320]
R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\N360\0305020.00B\BHDrvx86.sys [9/8/2009 4:44 PM 259632]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\N360\0305020.00B\cchpx86.sys [9/8/2009 4:44 PM 482432]
R1 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090910.003\IDSXpx86.sys [9/11/2009 7:49 PM 276344]
R2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [9/8/2009 1:48 AM 10384]
R2 N360;Norton 360;c:\program files\Norton 360\Engine\3.5.2.11\ccSvcHst.exe [9/8/2009 4:44 PM 117640]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [8/27/2009 7:12 PM 102448]
R3 LEqdUsb;Logitech SetPoint Unifying KMDF USB Filter;c:\windows\system32\drivers\LEqdUsb.sys [6/17/2009 10:55 AM 40720]
R3 LHidEqd;Logitech SetPoint Unifying KMDF HID Filter;c:\windows\system32\drivers\LHidEqd.sys [6/17/2009 10:55 AM 10384]
R3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.10.1;c:\windows\system32\drivers\libusb0.sys [4/1/2009 12:13 PM 33792]
R3 rt2870;Linksys 802.11n USB Wireless LAN Card Driver;c:\windows\system32\drivers\rt2870.sys [12/14/2007 6:04 PM 551680]
S2 libusbd;LibUsb-Win32 - Daemon, Version 0.1.10.1;system32\libusbd-nt.exe –> system32\libusbd-nt.exe [?]
S2 Roxio Upnp Server 10;Roxio Upnp Server 10;c:\program files\Roxio\Digital Home 10\RoxioUpnpService10.exe [8/24/2007 4:53 PM 362992]
S2 RoxWatch10;Roxio Hard Drive Watcher 10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatch10.exe [8/24/2007 4:52 PM 166384]
S3 cpuz129;cpuz129;\??\c:\program files\PC Wizard 2008\pcwiz32.sys –> c:\program files\PC Wizard 2008\pcwiz32.sys [?]
S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [8/21/2008 11:49 PM 18688]
S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [8/21/2008 11:49 PM 8320]
S3 motport;Motorola USB Diagnostic Port;c:\windows\system32\drivers\motport.sys [6/18/2007 8:18 PM 23680]
S3 Roxio UPnP Renderer 10;Roxio UPnP Renderer 10;c:\program files\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe [8/24/2007 4:53 PM 72176]
S3 RoxMediaDB10;RoxMediaDB10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe [8/24/2007 4:52 PM 1083888]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [5/6/2008 4:06 PM 11520]
S4 RoxLiveShare10;LiveShare P2P Server 10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe [8/24/2007 4:52 PM 309744]
S4 SessionLauncher;SessionLauncher; [x]
S4 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\system32\TUProgSt.exe [6/9/2009 9:57 AM 604488]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
.
——- Supplementary Scan ——-
.
uStart Page = about:blank
DPF: {E5ABEB00-B357-4884-9949-77B2C71A7EE3} - hxxp://www.intel.com/design/motherbd/boardid/BoardID.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-14 11:02
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\N360]
"ImagePath"="\"c:\program files\Norton 360\Engine\3.5.2.11\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files\Norton 360\Engine\3.5.2.11\diMaster.dll\" /prefetch:1"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-3562891378-3382784536-2106522743-1006\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_USERS\S-1-5-21-3562891378-3382784536-2106522743-1006\Software\SecuROM\License information*]
"datasecu"=hex:6d,09,31,83,80,14,3d,cd,36,92,33,0d,e4,7d,69,d7,9d,84,30,cb,2c,
02,63,e5,5b,bc,50,a8,ce,27,cf,41,2b,da,cf,51,38,c0,10,9f,d7,c8,e8,60,4d,82,\
"rkeysecu"=hex:cb,bd,f2,61,5a,4e,c6,95,f2,29,8b,82,ba,6b,3d,44

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG11.00.00.01WORKSTATION"="A2C8E5DB6AA25D8D864029F078C11E11C4E4F35159587378BDB402A3044401218BC3E26005E
F56EBD0E8651EAC4A040DC3844D5D0DD2FA6899D45A78BF33BA8335D225188CECD300B1AA4134CE0D
382E33B83EB3B27C59298AA0680A44D81E052DEC65F2CA611F8FF4C49A39726AB51C3BA869094FEED
F6336CAB25BA1A8F171B3EE31687AB992A618DB25B1A1688D4237E14795D5E8F483F56996F659B791
D63F95EB74CB85A0144E7966ACD72F67D1B557A317B2CB94BA5377C4EAE2C16BFEBC9E127BECC74CF
EBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6
A0AC4980AC79335D575E7D6A3B9808A6171C11EC38DE3D8EDD5E5BE2F6E66753ED658FEE39D999D83
362611C5FADE0046DCF4019816357A7EBF91C90A3467A382585EBEF9F83B42B1B4531C8E7C08EE211
98564B284BB5B6105CD4C8B24DC373B9752C50BA9B67066D592B4E6192D0A3BF378AC695F9F109B9A
B529CBA8610CB72FB15E4A95DA434EE6D78D0FA350DAFDA2908A2A57C8ACD882B66B1E69693CE4B47
BF860524F34297B994FBD8DD3FB5F5CBD179A6018EF1CD0438B5D2C7914BF36A9691D6746E011359D
17C106AF6265C633DE8DE5D232810C142D6908663D6CF58D9E61B714305C249D583AC57D6B90B17F4
1585087F690BD45449A4637648756B1D6BC567B2A93B6D95C72EC8176934F1F5A3451C70EFAA128F4
487134D3D3262C807BBC3150AC40A6281068501F23B64133F40DB56BA14B1EB84A7EE7B15845D1827
58975487DBCB5AEF9CF7F6593DC0F09609A9260C1E50B449E3F3AB739FE01A3B68196E48B1BF72D2C
D2F696184BE085DA88D67ED51ED875513421A40EB58B3B9ADA2753429D7F3F1E6DE5F1714FAA9C99A
B33628EC70D7717E9F19A984109D99DFB18F7ADD6CFB152BDC77C72172F5154E6BC2CCE29D6B68627
58D9DB8B96058A6E7780998B6FA8BD124DE85158A6100A8A9D12DDB23DD8A6FCE6F528B6ADE76A18B
7C975C55B5A68654D7250E8AB64B8185BB6030921EAACA5ECD3E369BCBF8E386FE1FDCC944BA67AF3
B44DC9C94BE253C6C42EE5EEEA18E77499DA22B2E68716675DC83FB1523089DF33D0751EBA4522BE4
F25BE067CA46941771F1D9E251C4DE6BCF6A3567BB6F288135471C814C3FD7B7536B55708473D001F
D764D99444CC2FDBFE52450689800F50F0AD2F00712EA8E0C495BCB338B6FE24AB78ED555E90E6034
F6DB380C72767AF870B228AC68AE26875479894077D32FA3F00D6E1EF3DE587B58D15D136002C8DD5
05A67185014CCF51E96911415066C19131791BA337540A575604FE9B83F31F0B44DC3A64F2E694AEE
FE1FA13335300040E4BC4CE7390787EE47F202C6EB16A959F22A3CDC3672BABEE33F5A98B0AB6FD00
D447742342D3D1A27025149EBEEBF"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(900)
c:\windows\system32\Ati2evxx.dll
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
c:\program files\common files\logishrd\bluetooth\LBTServ.dll

- - - - - - - > 'explorer.exe'(3732)
c:\windows\system32\WININET.dll
c:\program files\Logitech\SetPoint\GameHook.dll
c:\program files\Logitech\SetPoint\lgscroll.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCR80.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\IEFRAME.dll
c:\progra~1\WINDOW~3\wmpband.dll
c:\windows\system32\msi.dll
c:\windows\system32\mshtml.dll
c:\windows\system32\msls31.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2009-09-14 11:04
ComboFix-quarantined-files.txt 2009-09-14 17:03
ComboFix2.txt 2009-09-09 05:56
ComboFix3.txt 2009-09-08 08:19

Pre-Run: 34,073,403,392 bytes free
Post-Run: 34,097,999,872 bytes free

420 — E O F — 2009-09-10 09:03

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:20:26 AM, on 9/14/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Norton 360\Engine\3.5.2.11\ccSvcHst.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\oodag.exe
C:\Program Files\Norton 360\Engine\3.5.2.11\ccSvcHst.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\stsystra.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client;=dell-usuk&channel;=us&ibd;=2061210
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360\Engine\3.5.2.11\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360\Engine\3.5.2.11\IPSBHO.DLL
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\3.5.2.11\coIEPlg.dll
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKUS\S-1-5-18\..\RunOnce: [WUAppSetup] C:\Program Files\Common Files\logishrd\WUApp32.exe -v 0x046d -p 0x0990 -f video -m logitech -d 11.90.1262.0 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [WUAppSetup] C:\Program Files\Common Files\logishrd\WUApp32.exe -v 0x046d -p 0x0990 -f video -m logitech -d 11.90.1262.0 (User 'Default user')
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownlo…iaSmartScan.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {E5ABEB00-B357-4884-9949-77B2C71A7EE3} (BoardCtl Class) - http://www.intel.com/design/motherbd/boardid/BoardID.cab
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton 360\Engine\3.5.2.11\coIEPlg.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: LibUsb-Win32 - Daemon, Version 0.1.10.1 (libusbd) - http://libusb-win32.sourceforge.net - C:\WINDOWS\system32\libusbd-nt.exe
O23 - Service: Norton 360 (N360) - Symantec Corporation - C:\Program Files\Norton 360\Engine\3.5.2.11\ccSvcHst.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: O&O; Defrag - O&O; Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: Roxio UPnP Renderer 10 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe
O23 - Service: Roxio Upnp Server 10 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 10\RoxioUpnpService10.exe
O23 - Service: RoxMediaDB10 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe
O23 - Service: Roxio Hard Drive Watcher 10 (RoxWatch10) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatch10.exe

–
End of file - 5922 bytes

Im having some long hang times but otherwise normal

LDTate

Post #8September 14, 2009, 10:29 PM UTC

Remove IE8
http://support.microsoft.com/kb/957700

After the above let me know how it's running.

LDTate

Post #9September 20, 2009, 10:24 PM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] HJT Log

✨ Ask AI

Ask AI