My computer seems to be running better, I've not tried Photoshop yet, here's the Combfix log:
ComboFix 10-04-01.02 - Peter 04/02/2010 14:15:37.5.4 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2039.818 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: BitDefender Antivirus *On-access scanning disabled* (Updated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB}
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\Peter\My Documents\ZbThumbnail.info
c:\program files\AskSearch\bin\DefaultSearch.dll
c:\windows\AppPatch\AcAdProc.dll
c:\windows\BackUp
c:\windows\BackUp\S\50908000.DAT
c:\windows\eSellerateEngine.dll
c:\windows\system32\ReadMe.txt
c:\windows\system32\sqlite3.dll
c:\windows\xobglu16.dll
.
((((((((((((((((((((((((( Files Created from 2010-03-02 to 2010-04-02 )))))))))))))))))))))))))))))))
.
2010-04-02 13:52 . 2010-04-02 13:52 ——– d—–w- c:\program files\Microsoft ActiveSync
2010-04-02 13:47 . 2010-04-02 16:51 ——– d—–w- c:\program files\Mozilla Sunbird
2010-04-02 13:43 . 2010-04-02 13:43 ——– d—–w- c:\documents and settings\Peter\Local Settings\Application Data\Thunderbird
2010-04-02 13:43 . 2010-04-02 13:43 ——– d—–w- c:\documents and settings\Peter\Application Data\Thunderbird
2010-04-02 13:43 . 2010-04-02 16:40 ——– d—–w- c:\program files\Mozilla Thunderbird
2010-04-02 13:10 . 2010-04-02 13:10 ——– d—–w- c:\documents and settings\Peter\Application Data\OpenOffice.org
2010-04-02 13:05 . 2010-04-02 13:05 ——– d—–w- c:\program files\JRE
2010-04-02 13:05 . 2010-04-02 13:05 ——– d—–w- c:\program files\OpenOffice.org 3
2010-03-31 15:32 . 2010-03-31 15:33 ——– dc-h–w- c:\windows\ie8
2010-03-28 00:21 . 2010-03-28 00:21 ——– d—–w- c:\windows\system32\wbem\Repository
2010-03-25 13:46 . 2010-03-25 13:47 ——– d—–w- c:\program files\Common Files\Motive
2010-03-14 01:33 . 2010-03-14 02:17 ——– d—–w- c:\documents and settings\All Users\Application Data\Skype
2010-03-13 15:45 . 2008-04-14 00:12 53760 —-a-w- c:\windows\system32\drivers\vfwwdm32.dll
2010-03-13 15:45 . 2009-08-07 20:03 16512 —-a-w- c:\windows\system32\drivers\mobiolavs.sys
2010-03-13 15:38 . 2010-03-13 15:38 ——– d—–w- c:\documents and settings\All Users\Application Data\ZoomBrowser
2010-03-07 12:56 . 2010-03-07 12:56 ——– d—–w- c:\documents and settings\Peter\Library
2010-03-07 12:56 . 2010-03-07 12:56 ——– d—–w- c:\documents and settings\Peter\Application Data\com.adobe.ExMan
2010-03-04 19:45 . 2009-05-09 01:14 27792 —-a-w- c:\windows\system32\drivers\point32.sys
2010-03-04 19:44 . 2010-03-04 19:45 ——– d—–w- c:\program files\Microsoft IntelliPoint
2010-03-04 19:39 . 2008-04-14 00:11 21504 —-a-w- c:\windows\system32\hidserv.dll
2010-03-04 19:39 . 2008-04-14 00:11 21504 —-a-w- c:\windows\system32\dllcache\hidserv.dll
2010-03-04 19:39 . 2008-04-13 18:39 14592 —-a-w- c:\windows\system32\drivers\kbdhid.sys
2010-03-04 19:39 . 2008-04-13 18:39 14592 —-a-w- c:\windows\system32\dllcache\kbdhid.sys
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-02 18:32 . 2010-02-18 19:21 ——– d—–w- c:\program files\Common Files\Akamai
2010-04-02 18:04 . 2003-10-12 14:35 91456 -c–a-w- c:\documents and settings\Peter\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-04-02 13:05 . 2005-10-14 21:22 ——– d—–w- c:\program files\Common Files\Java
2010-04-02 13:04 . 2009-06-17 14:00 411368 —-a-w- c:\windows\system32\deploytk.dll
2010-04-02 12:53 . 2008-05-25 14:32 ——– d—–w- c:\documents and settings\All Users\Application Data\Google Updater
2010-04-02 12:38 . 2009-06-14 16:51 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-04-01 13:42 . 2009-07-24 16:26 291352 —-a-w- c:\windows\system32\drivers\bdfsfltr.sys
2010-03-31 15:19 . 2008-11-20 13:32 ——– d—–w- c:\documents and settings\Peter\Application Data\HPAppData
2010-03-30 04:46 . 2009-06-14 16:51 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-30 04:45 . 2009-06-14 16:51 20824 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-03-28 11:30 . 2007-02-03 20:46 ——– d—–w- c:\program files\BitTorrent
2010-03-28 00:13 . 2008-09-05 17:21 ——– d—–w- c:\program files\Verizon
2010-03-27 11:56 . 2009-06-13 12:55 ——– d—–w- c:\program files\RegCure
2010-03-26 13:56 . 2008-09-10 16:03 ——– d—–w- c:\documents and settings\All Users\Application Data\Motive
2010-03-23 13:31 . 2010-02-09 21:46 256 —-a-w- c:\windows\system32\pool.bin
2010-03-22 18:43 . 2008-03-26 01:30 ——– d—–w- c:\documents and settings\Peter\Application Data\FileZilla
2010-03-22 17:47 . 2008-03-26 01:28 ——– d—–w- c:\program files\FileZilla FTP Client
2010-03-14 02:18 . 2007-03-22 06:12 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-03-14 02:17 . 2006-08-16 11:29 ——– d—–w- c:\documents and settings\Peter\Application Data\Skype
2010-03-13 15:39 . 2006-01-04 21:36 ——– d—–w- c:\program files\Canon
2010-03-09 23:17 . 2008-09-19 19:03 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-03-09 22:42 . 2004-07-15 00:32 ——– d—–w- c:\documents and settings\Peter\Application Data\XnView
2010-03-03 23:48 . 2008-02-15 03:09 ——– d—–w- c:\program files\Windows Media Connect 2
2010-02-26 05:43 . 2010-02-26 05:43 81920 ——w- c:\windows\system32\ieencode.dll
2010-02-25 06:24 . 2006-06-23 16:33 916480 —-a-w- c:\windows\system32\wininet.dll
2010-02-24 19:25 . 2010-02-24 19:25 ——– d—–w- c:\program files\Auslogics
2010-02-18 19:47 . 2003-10-12 18:45 ——– d—–w- c:\program files\Common Files\Adobe
2010-02-18 19:44 . 2010-02-18 19:44 ——– d—–w- c:\program files\Adobe Media Player
2010-02-18 19:39 . 2010-02-18 19:39 ——– d—–w- c:\program files\Common Files\Adobe AIR
2010-02-17 18:26 . 2009-12-07 23:49 106464 —-a-w- c:\windows\system32\drivers\bdhv.sys
2010-02-17 18:16 . 2010-02-08 18:39 ——– d—–w- c:\documents and settings\All Users\Application Data\BitDefender
2010-02-11 12:48 . 2010-02-11 12:47 ——– d—–w- c:\documents and settings\Peter\Application Data\Blackberry Desktop
2010-02-10 16:32 . 2010-02-10 16:32 ——– d—–w- c:\documents and settings\Peter\Application Data\Windows Search
2010-02-09 22:09 . 2010-02-09 22:09 ——– d—–w- c:\documents and settings\LocalService\Application Data\Roxio
2010-02-09 22:09 . 2008-02-23 02:18 ——– d—–w- c:\documents and settings\Peter\Application Data\Roxio
2010-02-09 22:07 . 2010-02-09 22:07 ——– d—–w- c:\documents and settings\All Users\Application Data\Research In Motion
2010-02-09 22:07 . 2010-02-09 21:37 ——– d—–w- c:\program files\Research In Motion
2010-02-09 22:06 . 2010-02-09 21:46 ——– d—–w- c:\documents and settings\Peter\Application Data\Research In Motion
2010-02-09 21:53 . 2010-02-09 21:53 ——– d—–w- c:\documents and settings\Peter\Application Data\InstallShield
2010-02-09 21:53 . 2010-02-09 21:53 ——– d—–w- c:\documents and settings\All Users\Application Data\InstallShield
2010-02-09 21:53 . 2010-02-09 21:53 ——– d—–w- c:\documents and settings\All Users\Application Data\Sonic
2010-02-09 21:53 . 2010-02-09 21:51 ——– d—–w- c:\documents and settings\All Users\Application Data\Roxio
2010-02-09 21:52 . 2010-02-09 21:37 ——– d—–w- c:\program files\Common Files\Roxio Shared
2010-02-09 21:52 . 2010-02-09 21:51 ——– d—–w- c:\program files\Roxio
2010-02-09 21:51 . 2003-10-07 19:06 ——– d—–w- c:\program files\Common Files\Sonic Shared
2010-02-09 21:37 . 2010-02-09 21:37 ——– d—–w- c:\program files\Common Files\Research In Motion
2010-02-09 20:32 . 2009-12-07 23:46 153448 —-a-w- c:\windows\system32\drivers\bdfm.sys
2010-02-09 01:07 . 2010-02-08 19:05 ——– d—–w- c:\program files\Windows Desktop Search
2010-02-08 19:09 . 2010-02-08 19:09 ——– d—–w- c:\program files\Microsoft Office Outlook Connector
2010-02-08 19:09 . 2010-02-08 19:06 ——– d—–w- c:\program files\Microsoft
2010-02-08 19:09 . 2010-02-08 19:09 ——– d—–w- c:\program files\Windows Live SkyDrive
2010-02-08 19:07 . 2010-02-08 19:07 ——– d—–w- c:\program files\Common Files\Windows Live
2010-02-08 19:06 . 2010-02-08 19:06 ——– d—–w- c:\documents and settings\Peter\Application Data\Windows Desktop Search
2010-02-08 18:39 . 2010-02-08 18:38 ——– d—–w- c:\program files\Common Files\BitDefender
2010-02-08 18:39 . 2010-02-08 18:39 ——– d—–w- c:\documents and settings\Peter\Application Data\BitDefender
2010-02-08 18:39 . 2010-02-08 18:39 ——– d—–w- c:\program files\BitDefender
2010-02-08 18:24 . 2005-08-03 01:54 ——– d—–w- c:\program files\Spybot - Search & Destroy
2010-02-08 18:24 . 2005-08-03 01:55 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-02-08 18:23 . 2009-07-14 13:29 ——– d—–w- c:\program files\SpywareGuard
2010-02-06 13:10 . 2005-08-31 14:51 ——– d—–w- c:\program files\Google
2010-02-04 19:26 . 2009-06-16 12:01 ——– d—–w- c:\program files\COMODO
2010-01-18 12:46 . 2010-01-12 15:45 120 —-a-w- c:\windows\Gsegecuzoze.dat
2010-01-18 12:46 . 2010-01-12 15:45 0 —-a-w- c:\windows\Nvoco.bin
2010-01-12 19:53 . 2008-12-15 13:05 664 —-a-w- c:\windows\system32\d3d9caps.dat
2010-01-07 19:27 . 2003-07-11 14:58 79111 —-a-w- c:\windows\PCHealth\HelpCtr\OfflineCache\index.dat
2010-01-04 18:21 . 2010-01-04 18:21 902432 —-a-w- c:\windows\system32\drivers\tdrpm251.sys
2010-01-04 18:21 . 2010-01-04 15:42 570016 —-a-w- c:\windows\system32\drivers\timntr.sys
2010-01-04 18:20 . 2010-01-04 15:42 156928 —-a-w- c:\windows\system32\drivers\snapman.sys
2010-01-04 15:42 . 2010-01-04 15:42 902592 —-a-w- c:\windows\system32\drivers\tdrpm228.sys
2010-01-04 15:42 . 2010-01-04 15:42 44704 —-a-w- c:\windows\system32\drivers\tifsfilt.sys
2009-07-14 19:56 . 2009-07-14 19:56 61 –sh–w- c:\windows\cnerolf.dat
2005-05-26 22:15 . 2005-10-04 02:59 174080 -csha-w- c:\windows\SYSTEM32\sfpsys.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2008-10-24 206112]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BCMSMMSG"="BCMSMMSG.exe" [2003-08-29 122880]
"LVCOMSX"="c:\windows\System32\LVCOMSX.EXE" [2004-10-08 221184]
"PinnacleDriverCheck"="c:\windows\System32\PSDrvCheck.exe" [2003-12-04 406016]
"DVDSentry"="c:\windows\System32\DSentry.exe" [2002-08-14 28672]
"Verizon_McciTrayApp"="c:\program files\Verizon\McciTrayApp.exe" [2010-03-17 1565696]
"JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2007-03-20 36864]
"36X Raid Configurer"="c:\windows\system32\xRaidSetup.exe" [2007-11-19 1970176]
"HDAudDeck"="c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe" [2009-09-23 33665024]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-11-21 110184]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-11-21 12669544]
"BitDefender Antiphishing Helper"="c:\program files\BitDefender\BitDefender 2010\IEShow.exe" [2009-10-19 71152]
"BDAgent"="c:\program files\BitDefender\BitDefender 2010\bdagent.exe" [2010-04-01 1123360]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2009-05-26 1468296]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-01-11 246504]
c:\documents and settings\Peter\Start Menu\Programs\Startup\
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-12-15 384000]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Spyder3Utility.lnk - c:\program files\Datacolor\Spyder3Pro\Utility\Spyder3Utility.exe [2008-3-19 6333954]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ \0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\beep.sys]
@="beep"
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HotSync Manager.lnk]
backup=c:\windows\pss\HotSync Manager.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Windows Search.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk
backup=c:\windows\pss\Windows Search.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^Peter^Start Menu^Programs^Startup^DMI RAID Manager.lnk]
backup=c:\windows\pss\DMI RAID Manager.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^Peter^Start Menu^Programs^Startup^palmOne Registration.lnk]
backup=c:\windows\pss\palmOne Registration.lnkStartup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acronis Scheduler2 Service]
2009-10-19 17:10 377320 —-a-w- c:\program files\Common Files\Acronis\Schedule2\schedhlp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AcronisTimounterMonitor]
2009-10-19 17:14 960640 —-a-w- c:\program files\Acronis\TrueImageHome\TimounterMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS4ServiceManager]
2008-08-14 12:58 611712 —-a-w- c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BlackBerryAutoUpdate]
2009-05-12 16:36 623888 —-a-w- c:\program files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ContentTransferWMDetector.exe]
2009-07-30 21:05 497000 —-a-w- c:\program files\Sony\Content Transfer\ContentTransferWMDetector.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DwlClient]
2003-09-19 19:46 294912 —-a-w- c:\program files\Common Files\Dell\EUSW\Support.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2007-10-15 02:17 49152 -c–a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpqSRMon]
2007-08-22 21:31 80896 -c–a-w- c:\program files\HP\Digital Imaging\bin\HpqSRmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxWatchTray]
2009-04-11 19:17 236016 —-a-w- c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Six Engine]
2009-07-17 18:48 6038016 —-a-w- c:\program files\ASUS\Six Engine\SixEngine.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-07-25 09:23 149280 —-a-w- c:\program files\Java\jre6\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2008-05-25 14:32 68856 —-a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TrueImageMonitor.exe]
2009-10-19 16:56 4355576 —-a-w- c:\program files\Acronis\TrueImageHome\TrueImageMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"MagicTuneEngine"=2 (0x2)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableNotifications"= 1 (0x1)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Games\\Flight Simulator 9\\fs9.exe"=
"c:\\WINDOWS\\SYSTEM32\\dpnsvr.exe"=
"c:\\WINDOWS\\SYSTEM32\\dpvsetup.exe"=
"c:\\WINDOWS\\SYSTEM32\\dxdiag.exe"=
"c:\\WINDOWS\\SYSTEM32\\fxsclnt.exe"=
"c:\\Program Files\\Microsoft Expression\\Web 2\\WebDesigner\\EXPRWD.EXE"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Common Files\\Adobe\\Adobe Version Cue CS3\\Server\\bin\\VersionCueCS3.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3703:TCP"= 3703:TCP:Adobe Version Cue CS3 Server
"3704:TCP"= 3704:TCP:Adobe Version Cue CS3 Server
"50900:TCP"= 50900:TCP:Adobe Version Cue CS3 Server
"50901:TCP"= 50901:TCP:Adobe Version Cue CS3 Server
"5353:TCP"= 5353:TCP:Adobe CSI CS4
"1038:TCP"= 1038:TCP:Akamai NetSession Interface
"5000:UDP"= 5000:UDP:Akamai NetSession Interface
R0 inic1622;inic1622;c:\windows\SYSTEM32\DRIVERS\dmi1622.sys [12/24/2004 12:35 PM 45056]
R0 tdrpman251;Acronis Try&Decide and Restore Points filter (build 251);c:\windows\SYSTEM32\DRIVERS\tdrpm251.sys [1/4/2010 2:21 PM 902432]
R2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe -k Akamai [8/29/2002 6:00 AM 14336]
R2 AsSysCtrlService;ASUS System Control Service;c:\program files\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [1/16/2010 8:08 PM 90112]
R2 DvmMDES;DeviceVM Meta Data Export Service;c:\asus.sys\config\DVMExportService.exe [7/17/2009 4:25 PM 319488]
R3 bdfm;BDFM;c:\windows\SYSTEM32\DRIVERS\bdfm.sys [12/7/2009 7:46 PM 153448]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\SYSTEM32\DRIVERS\nvhda32.sys [8/21/2009 9:24 PM 57320]
R3 Spyder3;Datacolor Spyder3;c:\windows\SYSTEM32\DRIVERS\Spyder3.sys [3/19/2008 4:26 PM 12288]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\SYSTEM32\DRIVERS\viahduaa.sys [1/17/2010 12:48 AM 1399680]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [8/26/2009 11:57 AM 133104]
S2 Norton Internet Security;Norton Internet Security;"c:\program files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe" /s "Norton Internet Security" /m "c:\program files\Norton Internet Security\Engine\16.0.0.125\diMaster.dll" /prefetch:1 –> c:\program files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe [?]
S2 P1C1394;Phase One 1394 Camera Driver;c:\windows\system32\Drivers\p1c1394.sys –> c:\windows\system32\Drivers\p1c1394.sys [?]
S3 Arrakis3;BitDefender Arrakis Server;c:\program files\Common Files\BitDefender\BitDefender Arrakis Server\bin\arrakis3.exe [10/19/2009 5:06 PM 183880]
S3 kvnet;Kerio Virtual Network Adapter;c:\windows\SYSTEM32\DRIVERS\kvnet.sys [3/23/2009 10:25 AM 29696]
S3 kwflower;Kerio WinRoute Firewall Driver - Lower Layer;c:\windows\system32\DRIVERS\kwflower.sys –> c:\windows\system32\DRIVERS\kwflower.sys [?]
S3 mobiolavs;Mobiola Web Camera Video Source;c:\windows\SYSTEM32\DRIVERS\mobiolavs.sys [3/13/2010 11:45 AM 16512]
S3 PciCon;PciCon;\??\d:\pcicon.sys –> d:\PciCon.sys [?]
S3 SCR3xx USB Smart Card Reader;SCR3xx USB Smart Card Reader;c:\windows\SYSTEM32\DRIVERS\SCR3XX2K.sys [12/5/2008 10:28 AM 47488]
S3 scsiscan;SCSI Scanner Driver;c:\windows\SYSTEM32\DRIVERS\scsiscan.sys [9/14/2009 5:37 PM 11520]
S3 SNL320XP;SONIX MULTIMEDIA USB DEVICE DRIVER;c:\windows\SYSTEM32\DRIVERS\9kdUSBXP.sys [12/29/2008 2:01 PM 16000]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
bdx REG_MULTI_SZ scan
Akamai REG_MULTI_SZ Akamai
.
Contents of the 'Scheduled Tasks' folder
2010-04-02 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-04-25 15:47]
2010-04-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-26 15:57]
2010-04-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-26 15:57]
2003-10-12 c:\windows\Tasks\ISP signup reminder 1.job
- c:\windows\System32\OOBE\OOBEBALN.EXE [2002-08-29 00:12]
2010-04-01 c:\windows\Tasks\RegCure Program Check.job
- c:\program files\RegCure\RegCure.exe [2010-02-23 23:20]
2010-01-18 c:\windows\Tasks\RegCure Startup.job
- c:\program files\RegCure\RegCure.exe [2010-02-23 23:20]
2010-03-28 c:\windows\Tasks\RegCure.job
- c:\program files\RegCure\RegCure.exe [2010-02-23 23:20]
2010-04-02 c:\windows\Tasks\SDMsgUpdate (SD).job
- c:\progra~1\SMARTD~1\Messages\SDNotify.exe [2009-02-18 19:39]
2010-04-02 c:\windows\Tasks\Symantec NetDetect.job
- c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2004-02-02 22:38]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.longandfoster.com/index.aspx?FromParnter=true
uInternet Settings,ProxyOverride = 127.0.0.1;*.local
uSearchURL,(Default) = hxxp://toolbar.ask.com/toolbarv/askRedirect?o=20008&gct=&gc=1&q=%s
IE: Append to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Easy-WebPrint Add To Print List - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Easy-WebPrint High Speed Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint Preview - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
IE: Easy-WebPrint Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
DPF: {15AC034D-14DF-4AF8-9D02-29E1F56A8235} - hxxp://www.virgindigital.co.uk/activeX/VirginWMA.cab
DPF: {2AD5DBAE-2DDB-11D4-A96C-00E09872DF17} - hxxp://www.printroom.com/_vti_dnl/PrintroomUploaderX3.CAB
DPF: {85A9BDFA-93C0-4F1B-9AB6-B92A90E5B326} - hxxp://www.printroom.com/ImageUploader4.cab
FF - ProfilePath - c:\documents and settings\Peter\Application Data\Mozilla\Firefox\Profiles\iiv1fu3w.default\
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - ORPHANS REMOVED - - - -
URLSearchHooks-CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
URLSearchHooks-C94E154B-1459-4A47-966B-4B843BEFC7DB} - (no file)
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
ShellExecuteHooks-{AD0ACA58-656F-61DA-9DFE-5D20F4F611BA} - (no file)
MSConfigStartUp-Adobe Photo Downloader - c:\program files\Adobe\Adobe Photoshop Lightroom 1.3\apdproxy.exe
MSConfigStartUp-Adobe Version Cue CS2 - c:\program files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe
MSConfigStartUp-Yxiqano - c:\windows\owonetixivumeged.dll
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2010-04-02 14:36
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes …
scanning hidden autostart entries …
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HDAudDeck = c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe 1????????????????????????????????????????????????
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Norton Internet Security]
"ImagePath"="\"c:\program files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe\" /s \"Norton Internet Security\" /m \"c:\program files\Norton Internet Security\Engine\16.0.0.125\diMaster.dll\" /prefetch:1"
.
——————— LOCKED REGISTRY KEYS ———————
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{BEB3C0C7-B648-4257-96D9-B5D024816E27}\Version*Version]
"Version"=hex:ff,e2,87,c3,9b,49,61,d4,ea,d5,69,28,16,5b,f2,37,be,72,1c,d7,b4,
44,ea,c3,3d,ed,36,5a,96,49,84,cd,db,cc,14,2d,bc,c0,16,fc,84,01,19,4d,ce,3d,\
[HKEY_LOCAL_MACHINE\software\Minnetonka Audio Software\SurCode Dolby Digital Premiere\Version*Version]
"Version"=hex:ff,e2,87,c3,9b,49,61,d4,ea,d5,69,28,16,5b,f2,37,be,72,1c,d7,b4,
44,ea,c3,3d,ed,36,5a,96,49,84,cd,db,cc,14,2d,bc,c0,16,fc,84,01,19,4d,ce,3d,\
.
——————— DLLs Loaded Under Running Processes ———————
- - - - - - - > 'explorer.exe'(1236)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\windows\System32\SCardSvr.exe
c:\program files\Common Files\Acronis\Schedule2\schedul2.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\EPSON\EBAPI\eEBSVC.exe
c:\program files\Common Files\EPSON\EBAPI\SAgent2.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\LeapFrog\LeapFrog Connect\CommandService.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\windows\system32\SearchIndexer.exe
c:\windows\BCMSMMSG.exe
c:\program files\Canon\CAL\CALMAIN.exe
c:\windows\system32\RUNDLL32.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\system32\wscntfy.exe
c:\program files\OpenOffice.org 3\program\soffice.exe
c:\program files\OpenOffice.org 3\program\soffice.bin
c:\program files\Common Files\Java\Java Update\jucheck.exe
.
**************************************************************************
.
Completion time: 2010-04-02 14:46:18 - machine was rebooted
ComboFix-quarantined-files.txt 2010-04-02 18:46
Pre-Run: 52,082,475,008 bytes free
Post-Run: 52,009,713,664 bytes free
- - End Of File - - 210EED8B1011108634CBC681BFAFC179
