[Resolved] Old XP machine infected?

hi,

i recently got my old p4 with xp media center edition back up and running after over a year of no use, i think the last time it was on was december 08ish. Anyway, seeing as it hadnt been used for ages i ran spybot s&d (found nothing) and avira free (found nothing). ok i thought the system is good, ill just put it back on the home network with my other computers. I like to have the same protection on all my computers and i prefer norton so seeing as my subscription was almost up i go to the store and buy Norton 2010 and install it on all my computers and run full scans on all of em, all come back clean except my old p4 with xp, it found 2 infections (a0054070.exe and W32.IRCbot) but removed them and then malwarebytes found 2 also. The computer seems to be running fine. Now however i dont trust this machine on my network, is there any chance anything could have spread over my network/shared folders (im not currently turning any other comps on while this one is on and vice versa just to be safe), here are my logs, sorry for the long intro and thanks for any help


Malwarebytes' Anti-Malware 1.44
Database version: 3618
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

1/22/2010 10:55:39 PM
mbam-log-2010-01-22 (22-55-39).txt

Scan type: Quick Scan
Objects scanned: 128285
Time elapsed: 9 minute(s), 25 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Trymedia Systems (Adware.TryMedia) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-01-22 23:26:37
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\Dones\LOCALS~1\Temp\pxtdapob.sys


—- System - GMER 1.0.15 —-

SSDT 8ADCEE30 ZwAlertResumeThread
SSDT 8ADA98C0 ZwAlertThread
SSDT 8AD657C8 ZwAllocateVirtualMemory
SSDT 8AD7EEF0 ZwAssignProcessToJobObject
SSDT 8AE8A7D8 ZwConnectPort
SSDT \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwCreateKey [0xB6A21210]
SSDT 8AC6AF80 ZwCreateMutant
SSDT 8AFD6F58 ZwCreateSymbolicLinkObject
SSDT 8AD9A1B0 ZwCreateThread
SSDT 8AD8B3B0 ZwDebugActiveProcess
SSDT \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwDeleteKey [0xB6A21490]
SSDT \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwDeleteValueKey [0xB6A219F0]
SSDT 8A9FA108 ZwDuplicateObject
SSDT sptd.sys ZwEnumerateKey [0xB9EC3FB2]
SSDT sptd.sys ZwEnumerateValueKey [0xB9EC4340]
SSDT 8AA777A0 ZwFreeVirtualMemory
SSDT 8ADA6C90 ZwImpersonateAnonymousToken
SSDT 8ADDFAB0 ZwImpersonateThread
SSDT 8ADE73C0 ZwLoadDriver
SSDT 8AD811D8 ZwMapViewOfSection
SSDT 8ADD5A48 ZwOpenEvent
SSDT \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwOpenKey [0xB6A217A0]
SSDT 8AED3340 ZwOpenProcess
SSDT 8ADF5540 ZwOpenProcessToken
SSDT 8ADA7758 ZwOpenSection
SSDT 8AC6A008 ZwOpenThread
SSDT 8A99FF80 ZwProtectVirtualMemory
SSDT sptd.sys ZwQueryKey [0xB9EC4418]
SSDT sptd.sys ZwQueryValueKey [0xB9EC4298]
SSDT 8ADD62D0 ZwResumeThread
SSDT 8ADDCCF8 ZwSetContextThread
SSDT 8AB29528 ZwSetInformationProcess
SSDT 8AD8E428 ZwSetSystemInformation
SSDT \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwSetValueKey [0xB6A21C40]
SSDT 8ADBAE30 ZwSuspendProcess
SSDT 8ADE01E8 ZwSuspendThread
SSDT 8ADF1418 ZwTerminateProcess
SSDT 8ADD8008 ZwTerminateThread
SSDT 8ADD98F0 ZwUnmapViewOfSection
SSDT 8AA7A4F8 ZwWriteVirtualMemory

—- Devices - GMER 1.0.15 —-

Device 8B27E1E8
Device Ntfs.sys (NT File System Driver/Microsoft Corporation)
Device 8B034488
Device Fastfat.SYS (Fast FAT File System Driver/Microsoft Corporation)

AttachedDevice \Driver\Tcpip \Device\Ip SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)

Device \Driver\usbuhci \Device\USBPDO-0 8AFB7790
Device \Driver\usbuhci \Device\USBPDO-1 8AFB7790
Device \Driver\dmio \Device\DmControl\DmIoDaemon 8B20F1E8
Device \Driver\dmio \Device\DmControl\DmConfig 8B20F1E8
Device \Driver\dmio \Device\DmControl\DmPnP 8B20F1E8
Device \Driver\dmio \Device\DmControl\DmInfo 8B20F1E8
Device \Driver\usbuhci \Device\USBPDO-2 8AFB7790
Device \Driver\usbuhci \Device\USBPDO-3 8AFB7790
Device \Driver\usbehci \Device\USBPDO-4 8AFF4790

AttachedDevice \Driver\Tcpip \Device\Tcp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)

—- Registry - GMER 1.0.15 —-

Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\000a3a50a3d5
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\000a3a50a3d5@00197f9c62fa 0x8B 0x67 0xD1 0x86 …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 1351491924
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 393259331
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0xAC 0x34 0x44 0xD6 …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@p0 C:\Program Files\Alcohol Soft\Alcohol 120\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@ujdew 0x59 0x46 0x39 0x7F …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40@ujdew 0x0E 0x40 0x55 0xC6 …
Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\000a3a50a3d5 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\000a3a50a3d5@00197f9c62fa 0x8B 0x67 0xD1 0x86 …
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0xAC 0x34 0x44 0xD6 …
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@p0 C:\Program Files\Alcohol Soft\Alcohol 120\
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@ujdew 0x59 0x46 0x39 0x7F …
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40@ujdew 0x0E 0x40 0x55 0xC6 …
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0x79 0x0A 0x45 0xB8 …
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@p0 C:\Program Files\Alcohol Soft\Alcohol 120\
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@ujdew 0x59 0x46 0x39 0x7F …
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40@ujdew 0x77 0x9F 0xC5 0x68 …

—- EOF - GMER 1.0.15 —-


DDS (Ver_09-12-01.01) - NTFSx86
Run by [removed] at 23:38:03.98 on Fri 01/22/2010
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_17
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3070.2438 [GMT -8:00]

AV: Norton Internet Security *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security *enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\PROGRA~1\COMMON~1\Stardock\SDMCP.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\Logi_MwX.Exe
svchost.exe
svchost.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\stsystra.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Norton Internet Security\Engine\17.5.0.127\ccSvcHst.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\D-Link\SharePort\SharePort Network USB Utility.exe
C:\Program Files\ASUS\WLAN Card Utilities\RaUI.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\Stardock\Object Desktop\DesktopX\DesktopX.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\DOCUME~1\Dones\LOCALS~1\Temp\clclean.0001
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
svchost.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Norton Internet Security\Engine\17.5.0.127\ccSvcHst.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\Dones\Desktop\dds.scr

============== Pseudo HJT Report ===============

uSearch Page = hxxp://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://www.yahoo.com
uSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
uStart Page = about:blank
mDefault_Page_URL = hxxp://www.yahoo.com/
mDefault_Search_URL = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
mSearch Page =
mWindow Title = Windows Internet Explorer provided by Comcast
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
BHO: Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} -
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} -
BHO: Symantec NCO BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - c:\program files\norton internet security\engine\17.5.0.127\coIEPlg.dll
BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\program files\norton internet security\engine\17.5.0.127\IPSBHO.DLL
BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - c:\program files\norton internet security\engine\17.5.0.127\coIEPlg.dll
uRun: [AlcoholAutomount] "c:\program files\alcohol soft\alcohol 120\axcmd.exe" /automount
uRun: [Creative Detector] "c:\program files\creative\mediasource\detector\CTDetect.exe" /R
uRun: [DesktopX] "c:\program files\stardock\object desktop\desktopx\DesktopX.exe"
mRun: [ehTray] c:\windows\ehome\ehtray.exe
mRun: [Logitech Utility] Logi_MwX.Exe
mRun: [VoiceCenter] "c:\program files\creative\voicecenter\AndreaVC.exe" /tray
mRun: [SigmatelSysTrayApp] stsystra.exe
mRun: [CTSysVol] c:\program files\creative\sbaudigy\surround mixer\CTSysVol.exe /r
mRun: [MBMon] Rundll32 CTMBHA.DLL,MBMon
mRun: [UpdReg] c:\windows\UpdReg.EXE
mRun: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [D-Link Network USB Utility] c:\program files\d-link\shareport\SharePort Network USB Utility.exe -mini
mRun: [ASUS_Utility] "c:\program files\asus\wlan card utilities\RaUI.exe"
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\logite~1.lnk - c:\program files\logitech\setpoint\SetPoint.exe
IE: Send To &Bluetooth - c:\program files\belkin\bluetooth software\btsendto_ie_ctx.htm
IE: {669B269B-0D4E-41FB-A3D8-FD67CA94F646} - http://www.comcast.net/
IE: {8828075D-D097-4055-AA02-2DBFA9D85E8A} - http://www.comcastsupport.com/
IE: {97809617-3937-4F84-B335-9BB05EF1A8D4} - http://online.comcast.net/help/
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - c:\progra~1\yahoo!\messen~1\YPager.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {88CFA58B-A63F-4A94-9C54-0C7A58E3333E} - {17A84966-F1E9-4645-AA9E-5E771EE1C859} - c:\progra~1\nuclea~1\videoget\plugins\VIDEOG~1.DLL
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office12\REFIEBAR.DLL
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
DPF: {00B71CFB-6864-4346-A978-C0A14556272C} - hxxp://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} - hxxp://support.dell.com/systemprofiler/SysPro.CAB
DPF: {040F4385-8DAD-4306-94BF-B8291D841FAE} - hxxp://www.nintendowifi.com/troubleshooting/usbaptest.cab
DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} - hxxp://zone.msn.com/binFrameWork/v10/StagingUI.cab55579.cab
DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} - hxxp://downloadcenter.samsung.com/content/common/cab/DjVuControlLite_EN.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/8/b/d/8bd77752-5704-4d68-a152-f7252adaa4f2/LegitCheckControl.cab
DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} - hxxp://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} - hxxp://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab
DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} - hxxp://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8} - hxxps://www-secure.symantec.com/techsupp/asa/ctrl/SymAData.cab
DPF: {37A273C2-5129-11D5-BF37-00A0CCE8754B} - hxxp://asp.mathxl.com/wizmodules/testgen/installers/TestGenXInstall.cab
DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - hxxp://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.1.2.76.cab
DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} - hxxp://zone.msn.com/BinFrameWork/v10/ZBuddy.cab55579.cab
DPF: {44990200-3C9D-426D-81DF-AAB636FA4345} - hxxps://www-secure.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} - hxxps://www-secure.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
DPF: {4FE89055-5300-469E-AFAD-DEB3181EDE76} - hxxp://asp.mathxl.com/applets/PearsonInstallAsst.cab
DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} - hxxp://zone.msn.com/binframework/v10/ZPAChat.cab55579.cab
DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} - hxxp://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
DPF: {5D6F45B3-9043-443D-A792-115447494D24} - hxxp://messenger.zone.msn.com/EN-GB/a-UNO1/GAME_UNO1.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1263934025890
DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} - hxxp://www.systemrequirementslab.com/sysreqlab2.cab
DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - hxxp://download.divx.com/player/DivXBrowserPlugin.cab
DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} - hxxps://webdl.symantec.com/activex/symdlmgr.cab
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1263934016468
DPF: {809A6301-7B40-4436-A02C-87B8D3D7D9E3} - hxxp://zone.msn.com/bingame/zpagames/zpa_dmno.cab55579.cab
DPF: {87BE3784-6977-4E84-AA08-55A96B9CEAC5} - hxxp://leekonline01.viewnetcam.com/bl_camera.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} - hxxp://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {95D88B35-A521-472B-A182-BB1A98356421} - hxxp://asp.mathxl.com/books/_Players/PearsonInstallAsst2.cab
DPF: {97E71027-0BA2-44F2-97DB-F84D808ED0B6} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab55762.cab
DPF: {9BDF4724-10AA-43D5-BD15-AEA0D2287303} - hxxp://zone.msn.com/bingame/zpagames/zpa_txhe.cab79344.cab
DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - hxxp://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {CAC181B0-4D70-402D-B571-C596A47D0CE0} - hxxp://zone.msn.com/bingame/zpagames/zpa_pool.cab56649.cab
DPF: {CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.4.0/jinstall-1_4_0-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} - hxxp://zone.msn.com/binframework/v10/StProxy.cab55579.cab
DPF: {E6D23284-0E9B-417D-A782-03E4487FC947} - hxxp://asp.mathxl.com/books/_Players/MathPlayer.cab
DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} - hxxp://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
Notify: LBTWlgn - c:\program files\common files\logitech\bluetooth\LBTWlgn.dll
Notify: MCPClient - c:\progra~1\common~1\stardock\mcpstub.dll
SSODL: 0aMCPClient - {F5DF91F9-15E9-416B-A7C3-7519B11ECBFC} - c:\program files\common files\stardock\MCPCore.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\dones\applic~1\mozilla\firefox\profiles\q9vp0a6h.default\
FF - prefs.js: browser.startup.homepage - about:blank
FF - plugin: c:\documents and settings\all users\application data\nexonus\ngm\npNxGameUS.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

============= SERVICES / DRIVERS ===============

R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);c:\windows\system32\drivers\sfsync03.sys [2005-12-6 35328]
R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\nis\1105000.07f\symds.sys [2010-1-21 328752]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\nis\1105000.07f\symefa.sys [2010-1-21 172592]
R1 BHDrvx86;BHDrvx86;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nis_17.0.0.136\definitions\bashdefs\20091205.001\BHDrvx86.sys [2009-12-4 529456]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\nis\1105000.07f\cchpx86.sys [2010-1-21 501888]
R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\nis\1105000.07f\ironx86.sys [2010-1-21 116272]
R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]
R2 NIS;Norton Internet Security;c:\program files\norton internet security\engine\17.5.0.127\ccsvchst.exe [2010-1-21 126392]
R2 StarWindServiceAE;StarWind AE Service;c:\program files\alcohol soft\alcohol 120\starwind\StarWindServiceAE.exe [2007-5-28 275968]
R3 DlinkUDSMBus;UDS Master Bus of Kernel USB Software Bus by TCP;c:\windows\system32\drivers\DlinkUDSMBus.sys [2008-11-11 74624]
R3 DlinkUDSTcpBus;DlinkUDSTcpBus;c:\windows\system32\drivers\DlinkUDSTcpBus.sys [2008-11-11 97664]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2010-1-22 102448]
R3 IDSxpx86;IDSxpx86;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nis_17.0.0.136\definitions\ipsdefs\20100119.001\IDSXpx86.sys [2010-1-21 329592]
R3 NAVENG;NAVENG;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nis_17.0.0.136\definitions\virusdefs\20100122.025\NAVENG.SYS [2010-1-22 84912]
R3 NAVEX15;NAVEX15;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nis_17.0.0.136\definitions\virusdefs\20100122.025\NAVEX15.SYS [2010-1-22 1323568]
S3 jnv4_mib;jnv4_mib;\??\c:\docume~1\dones\locals~1\temp\jnv4_mib.sys –> c:\docume~1\dones\locals~1\temp\jnv4_mib.sys [?]
S3 vaxscsi;vaxscsi;c:\windows\system32\drivers\vaxscsi.sys –> c:\windows\system32\drivers\vaxscsi.sys [?]

=============== Created Last 30 ================

2010-01-23 06:43:11 0 d—–w- C:\Cleaning Tools
2010-01-22 04:43:34 47408 —-a-r- c:\windows\system32\drivers\SymIM.sys
2010-01-22 04:35:33 805 —-a-w- c:\windows\system32\drivers\SYMEVENT.INF
2010-01-22 04:35:33 7443 —-a-w- c:\windows\system32\drivers\SYMEVENT.CAT
2010-01-22 04:35:33 60808 —-a-w- c:\windows\system32\S32EVNT1.DLL
2010-01-22 04:35:33 124976 —-a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2010-01-22 04:35:33 0 d—–w- c:\program files\Symantec
2010-01-22 04:34:22 0 d—–w- c:\windows\system32\drivers\NIS
2010-01-22 04:21:17 0 d—–w- c:\program files\NortonInstaller
2010-01-21 08:19:49 0 d—–w- C:\Downloads
2010-01-21 05:03:29 805400 —-a-r- c:\windows\system32\tmp24.tmp
2010-01-20 07:17:52 0 d—–w- C:\KeyScan
2010-01-20 06:25:37 0 d—–w- c:\program files\D-Link
2010-01-20 04:31:36 0 d—–w- c:\docume~1\dones\applic~1\Malwarebytes
2010-01-20 04:31:32 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-20 04:31:30 0 d—–w- c:\docume~1\alluse~1\applic~1\Malwarebytes
2010-01-20 04:31:29 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-01-20 04:31:29 0 d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-01-20 02:04:30 21361 —-a-w- c:\windows\system32\drivers\AegisP.sys
2010-01-20 02:04:17 0 d—–w- c:\program files\ASUS
2010-01-20 01:35:52 376832 —-a-w- c:\windows\system32\AegisI5Installer.exe
2010-01-19 22:38:12 1089593 ——w- c:\windows\system32\dllcache\ntprint.cat
2010-01-19 22:36:20 0 d-sh–w- c:\documents and settings\dones\PrivacIE
2010-01-19 22:34:31 0 d-sh–w- c:\documents and settings\dones\IETldCache
2010-01-19 22:30:01 246272 ——w- c:\windows\system32\dllcache\ieproxy.dll
2010-01-19 22:30:01 12800 ——w- c:\windows\system32\dllcache\xpshims.dll
2010-01-19 22:29:56 0 d—–w- c:\windows\ie8updates
2010-01-19 22:29:53 92160 ——w- c:\windows\system32\dllcache\iecompat.dll
2010-01-19 22:28:29 0 dc-h–w- c:\windows\ie8
2010-01-19 21:14:21 2560 ——w- c:\windows\system32\xpsp4res.dll
2010-01-19 20:57:58 0 d–h–w- C:\1bf04f481221929020a66927
2010-01-19 20:57:43 0 d—–w- c:\windows\SxsCaPendDel
2010-01-19 20:48:07 15064 —-a-w- c:\windows\system32\wuapi.dll.mui
2010-01-19 19:55:52 56816 —-a-w- c:\windows\system32\drivers\avgntflt.sys
2010-01-19 19:24:41 483968 —-a-w- c:\windows\system32\drivers\rt61.sys

==================== Find3M ====================

2010-01-20 05:19:24 137688 —-a-w- c:\windows\system32\drivers\PnkBstrK.sys
2010-01-20 05:19:15 202040 —-a-w- c:\windows\system32\PnkBstrB.exe
2009-12-21 19:14:05 916480 —-a-w- c:\windows\system32\wininet.dll
2009-12-21 19:14:05 916480 ——w- c:\windows\system32\dllcache\wininet.dll
2009-12-21 19:14:05 1208832 ——w- c:\windows\system32\dllcache\urlmon.dll
2009-12-21 19:14:04 5942784 ——w- c:\windows\system32\dllcache\mshtml.dll
2009-12-21 19:14:04 206848 ——w- c:\windows\system32\dllcache\occache.dll
2009-12-21 19:14:03 594432 ——w- c:\windows\system32\dllcache\msfeeds.dll
2009-12-21 19:14:03 55296 ——w- c:\windows\system32\dllcache\msfeedsbs.dll
2009-12-21 19:14:03 25600 ——w- c:\windows\system32\dllcache\jsproxy.dll
2009-12-21 19:14:03 1985536 ——w- c:\windows\system32\dllcache\iertutil.dll
2009-12-21 19:14:03 184320 ——w- c:\windows\system32\dllcache\iepeers.dll
2009-12-21 19:14:02 11070464 ——w- c:\windows\system32\dllcache\ieframe.dll
2009-12-21 19:14:01 387584 ——w- c:\windows\system32\dllcache\iedkcs32.dll
2009-12-21 13:19:18 173056 ——w- c:\windows\system32\dllcache\ie4uinit.exe
2009-11-21 15:51:04 471552 —-a-w- c:\windows\system32\dllcache\aclayers.dll
2009-10-29 07:46:51 133120 —-a-w- c:\windows\system32\dllcache\extmgr.dll
2009-10-28 14:36:11 13824 ——w- c:\windows\system32\dllcache\ieudinit.exe
2006-01-28 08:37:43 56 –sh–r- c:\windows\system32\F1C4DAE5D6.sys
2008-08-23 19:51:35 32768 –sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008082320080824\index.dat

============= FINISH: 23:39:05.39 ===============

The computer seems to be running fine, it just has a lot of junk installed, but im sure that was me.

ComboFix 10-01-23.02 - Dones 01/23/2010 12:25:11.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3070.2550 [GMT -8:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: Norton Internet Security *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security *enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\desktop
c:\windows\desktop\Virtual Pool 3.lnk
c:\windows\kb913800.exe
c:\windows\system32\Data
c:\windows\system32\Thumbs.db
c:\windows\system32\tmp24.tmp
c:\windows\system32\tmp69.tmp

.
((((((((((((((((((((((((( Files Created from 2009-12-23 to 2010-01-23 )))))))))))))))))))))))))))))))
.

2010-01-23 20:10 . 2010-01-22 04:42 1647984 —-a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20100123.003\NAVEX32A.DLL
2010-01-23 20:10 . 2010-01-22 04:42 84912 —-a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20100123.003\NAVENG.SYS
2010-01-23 20:10 . 2010-01-22 04:42 371248 —-a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20100123.003\EECTRL.SYS
2010-01-23 20:10 . 2010-01-22 04:42 2747440 —-a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20100123.003\CCERASER.DLL
2010-01-23 20:10 . 2010-01-22 04:42 259440 —-a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20100123.003\ECMSVR32.DLL
2010-01-23 20:10 . 2010-01-22 04:42 177520 —-a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20100123.003\NAVENG32.DLL
2010-01-23 20:10 . 2010-01-22 04:42 1323568 —-a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20100123.003\NAVEX15.SYS
2010-01-23 20:10 . 2010-01-22 04:42 102448 —-a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20100123.003\ERASER.SYS
2010-01-23 06:43 . 2010-01-23 07:30 ——– d—–w- C:\Cleaning Tools
2010-01-23 06:41 . 2010-01-23 06:41 ——– d—–w- c:\program files\ERUNT
2010-01-22 04:43 . 2009-12-03 06:09 47408 —-a-r- c:\windows\system32\drivers\SymIM.sys
2010-01-22 04:42 . 2009-10-28 22:37 343088 —-a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20100119.001\IDSvix86.sys
2010-01-22 04:42 . 2009-10-28 22:37 329592 —-a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20100119.001\IDSXpx86.sys
2010-01-22 04:42 . 2009-10-28 22:37 811896 —-a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20100119.001\Scxpx86.dll
2010-01-22 04:42 . 2009-10-28 22:37 488312 —-a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20100119.001\IDSxpx86.dll
2010-01-22 04:42 . 2009-10-28 22:37 466992 —-a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20100119.001\IDSviA64.sys
2010-01-22 04:35 . 2009-12-10 03:16 784752 —-a-r- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\coFFPlgn\components\coFFPlgn.dll
2010-01-22 04:35 . 2009-10-01 09:19 164216 —-a-r- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\IPSFFPlgn\components\IPSFFPl.dll
2010-01-22 04:35 . 2010-01-22 04:35 ——– d—–w- c:\program files\Symantec
2010-01-22 04:35 . 2010-01-22 04:35 60808 —-a-w- c:\windows\system32\S32EVNT1.DLL
2010-01-22 04:35 . 2010-01-22 04:35 124976 —-a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2010-01-22 04:21 . 2010-01-22 09:52 ——– d—–w- c:\program files\NortonInstaller
2010-01-21 08:19 . 2010-01-21 08:19 ——– d—–w- C:\Downloads
2010-01-21 01:15 . 2010-01-21 01:15 ——– d-sh–w- c:\documents and settings\LocalService\IETldCache
2010-01-20 07:17 . 2010-01-20 07:17 ——– d—–w- C:\KeyScan
2010-01-20 06:25 . 2010-01-20 06:25 ——– d—–w- c:\program files\D-Link
2010-01-20 04:31 . 2010-01-20 04:31 ——– d—–w- c:\documents and settings\Dones\Application Data\Malwarebytes
2010-01-20 04:31 . 2010-01-08 00:07 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-20 04:31 . 2010-01-20 04:31 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-01-20 04:31 . 2010-01-20 04:34 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-01-20 04:31 . 2010-01-08 00:07 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-01-20 02:04 . 2010-01-20 02:04 21361 —-a-w- c:\windows\system32\drivers\AegisP.sys
2010-01-20 02:04 . 2010-01-20 02:04 ——– d—–w- c:\program files\ASUS
2010-01-20 01:35 . 2010-01-20 02:04 376832 —-a-w- c:\windows\system32\AegisI5Installer.exe
2010-01-19 22:36 . 2010-01-19 22:36 ——– d-sh–w- c:\documents and settings\Dones\PrivacIE
2010-01-19 22:35 . 2010-01-19 22:35 ——– d-sh–w- c:\documents and settings\NetworkService\IETldCache
2010-01-19 22:34 . 2010-01-19 22:34 ——– d-sh–w- c:\documents and settings\Dones\IETldCache
2010-01-19 22:30 . 2009-12-21 19:14 12800 ——w- c:\windows\system32\dllcache\xpshims.dll
2010-01-19 22:30 . 2009-12-21 19:14 246272 ——w- c:\windows\system32\dllcache\ieproxy.dll
2010-01-19 22:29 . 2010-01-22 03:50 ——– d—–w- c:\windows\ie8updates
2010-01-19 22:29 . 2009-10-02 04:44 92160 ——w- c:\windows\system32\dllcache\iecompat.dll
2010-01-19 22:28 . 2010-01-19 22:29 ——– dc-h–w- c:\windows\ie8
2010-01-19 21:14 . 2008-05-03 11:55 2560 ——w- c:\windows\system32\xpsp4res.dll
2010-01-19 20:57 . 2010-01-19 20:58 ——– d—–w- C:\1bf04f481221929020a66927
2010-01-19 20:57 . 2010-01-19 21:09 ——– d—–w- c:\windows\SxsCaPendDel
2010-01-19 20:27 . 2010-01-19 20:27 10134 —-a-r- c:\documents and settings\Dones\Application Data\Microsoft\Installer\{3101CB58-3482-4D21-AF1A-7057FC935355}\ARPPRODUCTICON.exe
2010-01-19 19:55 . 2010-01-22 03:18 56816 —-a-w- c:\windows\system32\drivers\avgntflt.sys
2010-01-19 19:55 . 2010-01-19 19:55 152576 —-a-w- c:\documents and settings\Dones\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2010-01-19 19:49 . 2010-01-19 19:55 79488 —-a-w- c:\documents and settings\Dones\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2010-01-19 19:24 . 2007-07-29 00:10 483968 —-a-w- c:\windows\system32\drivers\rt61.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-22 10:10 . 2008-06-05 22:51 ——– d—–w- c:\program files\Spybot - Search & Destroy
2010-01-22 10:03 . 2006-02-03 01:53 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-01-22 04:50 . 2006-02-01 18:21 ——– d—–w- c:\program files\Common Files\Symantec Shared
2010-01-22 04:35 . 2010-01-22 04:35 805 —-a-w- c:\windows\system32\drivers\SYMEVENT.INF
2010-01-22 04:35 . 2010-01-22 04:35 7443 —-a-w- c:\windows\system32\drivers\SYMEVENT.CAT
2010-01-22 04:34 . 2010-01-22 04:34 ——– d—–w- c:\program files\Windows Sidebar
2010-01-22 04:34 . 2008-12-18 01:33 ——– d—–w- c:\program files\Norton Internet Security
2010-01-22 04:34 . 2008-11-12 21:04 ——– d—–w- c:\documents and settings\All Users\Application Data\Norton
2010-01-22 04:21 . 2008-11-12 21:03 ——– d—–w- c:\documents and settings\All Users\Application Data\NortonInstaller
2010-01-21 08:43 . 2006-01-20 08:28 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-01-21 07:43 . 2006-02-03 20:46 ——– d—–w- c:\program files\DivX
2010-01-21 07:38 . 2006-03-24 08:42 ——– d—–w- c:\documents and settings\All Users\Application Data\HDD Thermometer
2010-01-21 05:02 . 2007-03-24 17:43 ——– d–h–w- c:\documents and settings\Dones\Application Data\Move Networks
2010-01-21 04:54 . 2009-01-05 08:50 ——– d—–w- c:\program files\PeerGuardian2
2010-01-21 04:48 . 2007-10-27 05:36 ——– d—–w- c:\documents and settings\Dones\Application Data\GetRight
2010-01-21 04:47 . 2008-12-22 10:44 393216 —-a-w- c:\documents and settings\All Users\Application Data\NexonUS\NGM\NGMResource.dll
2010-01-21 04:42 . 2006-02-06 20:56 ——– d—–w- c:\program files\Common Files\Stardock
2010-01-21 04:32 . 2006-02-01 23:04 ——– d—–w- c:\program files\Logitech
2010-01-21 04:32 . 2006-02-01 23:04 ——– d—–w- c:\program files\Common Files\Logitech
2010-01-20 07:29 . 2006-01-20 08:34 ——– d—–w- c:\program files\Common Files\AOL
2010-01-20 07:24 . 2007-05-07 22:15 ——– d—–w- c:\documents and settings\Dones\Application Data\yahoo!
2010-01-20 07:24 . 2007-02-10 21:12 ——– d—–w- c:\documents and settings\All Users\Application Data\Yahoo!
2010-01-20 07:22 . 2007-10-13 23:37 ——– d—–w- c:\program files\Rockstar Games
2010-01-20 07:05 . 2008-02-23 08:44 ——– d—–w- c:\program files\xtra-icons
2010-01-20 05:19 . 2007-08-25 02:30 137688 —-a-w- c:\windows\system32\drivers\PnkBstrK.sys
2010-01-20 05:19 . 2007-08-25 02:30 202040 —-a-w- c:\windows\system32\PnkBstrB.exe
2010-01-20 05:00 . 2006-02-07 02:01 ——– d—–w- c:\documents and settings\Dones\Application Data\Azureus
2010-01-20 05:00 . 2008-04-02 07:22 ——– d—–w- c:\documents and settings\Dones\Application Data\uTorrent
2010-01-20 04:42 . 2006-01-27 09:40 71944 —-a-w- c:\documents and settings\Dones\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-01-19 22:49 . 2007-02-17 08:01 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-01-19 22:47 . 2007-02-17 08:08 ——– d—–w- c:\program files\Microsoft Works
2010-01-19 20:29 . 2008-11-26 06:04 ——– d—–w- c:\program files\Common Files\Logishrd
2010-01-19 19:56 . 2006-01-20 08:22 ——– d—–w- c:\program files\Java
2009-12-21 19:14 . 2005-08-16 10:18 916480 —-a-w- c:\windows\system32\wininet.dll
2009-12-05 04:54 . 2009-12-05 04:54 529456 —-a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20091205.001\BHDrvx86.sys
2009-12-05 04:54 . 2009-12-05 04:54 201616 —-a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20091205.001\BHRules.dll
2009-12-05 04:54 . 2009-12-05 04:54 1405840 —-a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20091205.001\BHEngine.dll
2009-12-05 04:54 . 2009-12-05 04:54 668720 —-a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20091205.001\BHDrvx64.sys
2009-12-05 04:54 . 2009-12-05 04:54 610704 —-a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20091205.001\bbRGen.dll
2009-11-21 15:51 . 2005-08-16 10:18 471552 —-a-w- c:\windows\AppPatch\aclayers.dll
2009-10-28 22:37 . 2009-10-28 22:37 343088 —-a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\BinHub\IDSvix86.sys
2009-10-28 22:37 . 2009-10-28 22:37 329592 —-a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\BinHub\IDSXpx86.sys
2009-10-28 22:37 . 2009-10-28 22:37 811896 —-a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\BinHub\Scxpx86.dll
2009-10-28 22:37 . 2009-10-28 22:37 488312 —-a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\BinHub\IDSxpx86.dll
2009-10-28 22:37 . 2009-10-28 22:37 466992 —-a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\BinHub\IDSviA64.sys
2007-08-25 03:52 . 2008-02-28 08:39 300400 —-a-w- c:\program files\mozilla firefox\components\coFFPlgn.dll
2006-01-28 08:37 . 2006-01-27 09:39 56 –sh–r- c:\windows\system32\F1C4DAE5D6.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-07-02 220544]
"Creative Detector"="c:\program files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-03 102400]
"DesktopX"="c:\program files\Stardock\Object Desktop\DesktopX\DesktopX.exe" [2003-10-28 585728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-29 67584]
"Logitech Utility"="Logi_MwX.Exe" [2003-12-17 19968]
"VoiceCenter"="c:\program files\Creative\VoiceCenter\AndreaVC.exe" [2005-02-23 1159168]
"SigmatelSysTrayApp"="stsystra.exe" [2005-03-22 339968]
"CTSysVol"="c:\program files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-02-15 57344]
"MBMon"="CTMBHA.DLL" [2005-05-19 1345520]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-07 13574144]
"nwiz"="nwiz.exe" [2008-10-07 1630208]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-10-07 86016]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"D-Link Network USB Utility"="c:\program files\D-Link\SharePort\SharePort Network USB Utility.exe" [2008-12-27 2605312]
"ASUS_Utility"="c:\program files\ASUS\WLAN Card Utilities\RaUI.exe" [2009-05-14 2228224]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2008-12-17 813584]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2009-07-20 20:28 72208 —-a-w- c:\program files\Common Files\Logitech\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\MCPClient]
2003-08-25 18:25 139264 —-a-w- c:\progra~1\COMMON~1\Stardock\MCPStub.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.exe.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.exe.lnk
backup=c:\windows\pss\Adobe Gamma Loader.exe.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^dlbcserv.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\dlbcserv.lnk
backup=c:\windows\pss\dlbcserv.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
2005-06-10 16:44 249856 —-a-w- c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
2005-06-10 16:44 81920 —-a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Kernel and Hardware Abstraction Layer]
2009-06-17 16:55 55824 —-a-w- c:\windows\KHALMNPR.Exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12 1695232 —-a-w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
2001-07-09 10:50 155648 —-a-w- c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2008-03-29 06:37 413696 —-a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SetDefaultMIDI]
2004-12-23 02:40 24576 —-a-w- c:\windows\MIDIDEF.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2006-02-03 20:39 180269 —-a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VoiceCenter]
2005-02-23 18:08 1159168 ——w- c:\program files\Creative\VoiceCenter\AndreaVC.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"LexBceS"=2 (0x2)
"LBTServ"=3 (0x3)
"JavaQuickStarterService"=2 (0x2)
"Ati HotKey Poller"=2 (0x2)
"usnjsvc"=3 (0x3)
"OOD2000"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"c:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\mIRC\\mirc.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Sierra Entertainment\\World in Conflict\\wic.exe"=
"c:\\Program Files\\Sierra Entertainment\\World in Conflict\\wic_online.exe"=
"c:\\Program Files\\Sierra Entertainment\\World in Conflict\\wic_ds.exe"=
"c:\\Program Files\\id Software\\Enemy Territory - QUAKE Wars\\etqwded.exe"=
"c:\\Program Files\\Unreal Tournament 3\\Binaries\\UT3.exe"=
"c:\\Program Files\\THQ\\Company of Heroes\\RelicCOH.exe"=
"c:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
"c:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
"c:\\Program Files\\id Software\\Enemy Territory - QUAKE Wars\\etqw.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Microsoft Games\\Rise of Nations\\thrones.exe"=
"c:\\Program Files\\Hamachi\\hamachi.exe"=
"c:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Civilization4.exe"=
"c:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Warlords\\Civ4Warlords.exe"=
"c:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Warlords\\Civ4Warlords_PitBoss.exe"=
"c:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Beyond the Sword\\Civ4BeyondSword.exe"=
"c:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Beyond the Sword\\Civ4BeyondSword_PitBoss.exe"=
"c:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\2K Games\\Firaxis Games\\Sid Meier's Civilization IV Colonization\\Colonization.exe"=
"c:\\Program Files\\Codemasters\\GRID\\GRID.exe"=
"c:\\Program Files\\Ubisoft\\Far Cry 2\\bin\\FarCry2.exe"=
"c:\\Program Files\\Ubisoft\\Far Cry 2\\bin\\FC2Launcher.exe"=
"c:\\Program Files\\Ubisoft\\Far Cry 2\\bin\\FC2Editor.exe"=
"c:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaW.exe"=
"c:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaWmp.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\NexonUS\\NGM\\NGM.exe"=
"c:\\Program Files\\PeerGuardian2\\pg2.exe"=
"c:\\Program Files\\D-Link\\SharePort\\SharePort Network USB Utility.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9303:UDP"= 9303:UDP:SharePort Network USB Utility UDP Port

R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);c:\windows\system32\drivers\sfsync03.sys [12/6/2005 7:11 AM 35328]
R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NIS\1105000.07F\symds.sys [1/21/2010 10:21 PM 328752]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NIS\1105000.07F\symefa.sys [1/21/2010 10:21 PM 172592]
R1 BHDrvx86;BHDrvx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20091205.001\BHDrvx86.sys [12/4/2009 8:54 PM 529456]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NIS\1105000.07F\cchpx86.sys [1/21/2010 10:21 PM 501888]
R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NIS\1105000.07F\ironx86.sys [1/21/2010 10:21 PM 116272]
R2 NIS;Norton Internet Security;c:\program files\Norton Internet Security\Engine\17.5.0.127\ccsvchst.exe [1/21/2010 10:20 PM 126392]
R3 DlinkUDSMBus;UDS Master Bus of Kernel USB Software Bus by TCP;c:\windows\system32\drivers\DlinkUDSMBus.sys [11/11/2008 3:01 PM 74624]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [1/22/2010 1:31 AM 102448]
R3 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20100119.001\IDSXpx86.sys [1/21/2010 8:42 PM 329592]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [4/16/2006 12:37 AM 685816]
S3 DlinkUDSTcpBus;DlinkUDSTcpBus;c:\windows\system32\drivers\DlinkUDSTcpBus.sys [11/11/2008 3:01 PM 97664]
S3 jnv4_mib;jnv4_mib;\??\c:\docume~1\Dones\LOCALS~1\Temp\jnv4_mib.sys –> c:\docume~1\Dones\LOCALS~1\Temp\jnv4_mib.sys [?]
S3 vaxscsi;vaxscsi;c:\windows\system32\Drivers\vaxscsi.sys –> c:\windows\system32\Drivers\vaxscsi.sys [?]
.
Contents of the 'Scheduled Tasks' folder

2010-01-22 c:\windows\Tasks\Norton Internet Security - Run Full System Scan - Dones.job
- c:\program files\Norton Internet Security\Engine\17.5.0.127\navw32.exe [2010-01-22 06:08]
.
.
——- Supplementary Scan ——-
.
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
uStart Page = about:blank
mWindow Title = Windows Internet Explorer provided by Comcast
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
IE: Send To &Bluetooth - c:\program files\Belkin\Bluetooth Software\btsendto_ie_ctx.htm
DPF: {040F4385-8DAD-4306-94BF-B8291D841FAE} - hxxp://www.nintendowifi.com/troubleshooting/usbaptest.cab
FF - ProfilePath - c:\documents and settings\Dones\Application Data\Mozilla\Firefox\Profiles\q9vp0a6h.default\
FF - prefs.js: browser.startup.homepage - about:blank
FF - plugin: c:\documents and settings\All Users\Application Data\NexonUS\NGM\npNxGameUS.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-ATICCC - c:\program files\ATI Technologies\ATI.ACE\cli.exe
MSConfigStartUp-ATIPTA - c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe
MSConfigStartUp-CTSVolFE - c:\program files\Creative\Mixer\CTSVolFE.exe
MSConfigStartUp-iTunesHelper - c:\program files\iTunes\iTunesHelper.exe
MSConfigStartUp-LoadMSvcmm - c:\program files\Movielink\MovielinkManager\Movielink User.exe
MSConfigStartUp-SunJavaUpdateSched - c:\program files\Java\jre1.5.0_06\bin\jusched.exe
AddRemove-Vodei Multimedia Processor - c:\program files\Vodei\uninst.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-23 12:31
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NIS]
"ImagePath"="\"c:\program files\Norton Internet Security\Engine\17.5.0.127\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files\Norton Internet Security\Engine\17.5.0.127\diMaster.dll\" /prefetch:1"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-2158516878-4142291126-659350159-1005\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_USERS\S-1-5-21-2158516878-4142291126-659350159-1005\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID]
@Denied: (Full) (LocalSystem)
@SACL=

[HKEY_USERS\S-1-5-21-2158516878-4142291126-659350159-1005\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:05,17,a2,ca,5b,34,93,22,65,95,db,a1,8e,db,2c,14,75,ba,a3,74,58,bd,e7,
e2,a0,30,de,22,ec,e6,75,30,f7,c1,58,d8,db,aa,ca,30,f0,88,2c,60,ad,00,60,9e,\
"??"=hex:49,9a,55,4d,5d,f4,c5,c3,e7,d2,fb,f6,13,3e,27,61

[HKEY_USERS\S-1-5-21-2158516878-4142291126-659350159-1005\Software\SecuROM\License information*]
"datasecu"=hex:1a,2d,25,c3,9c,27,3e,a2,50,37,a3,55,1c,4e,61,79,4c,fb,b1,9b,ca,
13,1d,d4,33,f0,a7,ff,af,4d,6f,ab,9b,2f,e9,07,5e,41,5d,e7,52,c7,d8,0c,60,df,\
"rkeysecu"=hex:d1,63,0b,6a,fc,27,2d,f8,b5,14,62,a4,07,55,38,99
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(924)
c:\program files\common files\logitech\bluetooth\LBTWlgn.dll
c:\progra~1\COMMON~1\Stardock\mcpstub.dll
c:\program files\common files\logitech\bluetooth\LBTServ.dll
.
Completion time: 2010-01-23 12:35:10
ComboFix-quarantined-files.txt 2010-01-23 20:35

Pre-Run: 34,675,363,840 bytes free
Post-Run: 34,627,887,104 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Windows XP Media Center Edition" /fastdetect /NoExecute=OptIn

- - End Of File - - B0F4CF3E7817DCBFCBB98FA2A7CBDBFE