[Resolved] TR/Crypt.XPACK.Gen

I uploaded to Avira Personal Version 10 and when attempting a full scan for the first time the TR/Crypt.XPACK.Gen was detected. It would not complete the scan but instead appeared to scan in circles never reaching more than 18.3% complete. I have removed the Trend Micro software but still have both the Norton and Avira. I understand now that I should only have 1 but not sure which. I am sending all info requested to help you diagnose the problem.


DDS (Ver_09-06-26.01) - NTFSx86
Run by [removed] at 0:39:09.46 on Fri 04/02/2010
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.766.296 [GMT -4:00]

AV: Norton Internet Security *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
FW: Norton Internet Security *disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe



GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-04-02 08:04:11
Windows 5.1.2600 Service Pack 3
Running: o0gtbfj6.exe; Driver: C:\DOCUME~1\STEPHA~1\LOCALS~1\Temp\fxtdqpoc.sys


—- System - GMER 1.0.15 —-

SSDT 82D72050 ZwAlertResumeThread
SSDT 82D66050 ZwAlertThread
SSDT 82D2B400 ZwAllocateVirtualMemory
SSDT 82EAA050 ZwAssignProcessToJobObject
SSDT 83ADE780 ZwConnectPort
SSDT F7F0185E ZwCreateKey
SSDT 82E9F130 ZwCreateMutant
SSDT 82D31A30 ZwCreateSymbolicLinkObject
SSDT F7F01854 ZwCreateThread
SSDT 82DAD050 ZwDebugActiveProcess
SSDT F7F01863 ZwDeleteKey
SSDT F7F0186D ZwDeleteValueKey
SSDT 82DBEC00 ZwDuplicateObject
SSDT 82D27E78 ZwFreeVirtualMemory
SSDT 82E99050 ZwImpersonateAnonymousToken
SSDT 82E12050 ZwImpersonateThread
SSDT 83C1F1B0 ZwLoadDriver
SSDT F7F01872 ZwLoadKey
SSDT 82D27D98 ZwMapViewOfSection
SSDT 82D63050 ZwOpenEvent
SSDT \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwOpenKey [0xEECF17A0]
SSDT F7F01840 ZwOpenProcess
SSDT 83A4F050 ZwOpenProcessToken
SSDT 82D79050 ZwOpenSection
SSDT F7F01845 ZwOpenThread
SSDT 82D31B00 ZwProtectVirtualMemory
SSDT F7F0187C ZwReplaceKey
SSDT F7F01877 ZwRestoreKey
SSDT 83A45050 ZwResumeThread
SSDT 82E09050 ZwSetContextThread
SSDT 82E8EB70 ZwSetInformationProcess
SSDT 82E98050 ZwSetSystemInformation
SSDT F7F01868 ZwSetValueKey
SSDT 82D78050 ZwSuspendProcess
SSDT 82E0B050 ZwSuspendThread
SSDT 82E0A050 ZwTerminateProcess
SSDT 82D5A050 ZwTerminateThread
SSDT 82EB5050 ZwUnmapViewOfSection
SSDT 82D2B330 ZwWriteVirtualMemory

—- Devices - GMER 1.0.15 —-

AttachedDevice \FileSystem\Ntfs \Ntfs TmPreFlt.sys
AttachedDevice \Driver\Tcpip \Device\Ip SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Tcp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Udp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\RawIp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)

Device EC4EAD20
Device EC502631

AttachedDevice fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

Device \Driver\TmPreFilter \FileSystem\Filters\Tmpreflt TmPreFlt.sys
Device InCDfs.SYS (InCD File System Driver/Ahead Software AG)

—- EOF - GMER 1.0.15 —-

C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\Program Files\Ahead\InCD\InCDsrv.exe
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir Desktop\sched.exe
svchost.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton Internet Security\Engine\17.5.0.127\ccSvcHst.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Norton Internet Security\Engine\17.5.0.127\ccSvcHst.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\Stephany Turner\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.usatoday.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = iexplore
BHO: AutorunsDisabled - No File
BHO: Symantec NCO BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - c:\program files\norton internet security\engine\17.5.0.127\coIEPlg.dll
BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\program files\norton internet security\engine\17.5.0.127\IPSBHO.DLL
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - c:\program files\norton internet security\engine\17.5.0.127\coIEPlg.dll
TB: {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - No File
EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
EB: &Research: {ff059e31-cc5a-4e2e-bf3b-96e929d65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
dRun: [Photo TurboBackup] c:\progra~1\filest~1\photot~1\pbksche.exe -s
dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
dRunOnce: [RunNarrator] Narrator.exe
StartupFolder: c:\docume~1\stepha~1\startm~1\programs\startup\autoru~1\logite~1.lnk - c:\program files\logitech\logitech webcam software\eReg.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
DPF: {00134F72-5284-44F7-95A8-52A619F70751} - hxxps://72.149.162.78:4343/officescan/console/ClientInstall/WinNTChk.cab
DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} - hxxps://support.microsoft.com/OAS/ActiveX/MSDcode.cab
DPF: {08D75BB0-D2B5-11D1-88FC-0080C859833B} - hxxps://72.149.162.78:4343/officescan/console/ClientInstall/setupini.cab
DPF: {08D75BC1-D2B5-11D1-88FC-0080C859833B} - hxxps://72.149.162.78:4343/officescan/console/ClientInstall/setup.cab
DPF: {119CE688-A7E9-1941-8E10-F42990BBA4C4} - hxxps://fiserv.assurity.com/reports/control/ASRrptview.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/8/b/d/8bd77752-5704-4d68-a152-f7252adaa4f2/LegitCheckControl.cab
DPF: {1851174C-97BD-4217-A0CC-E908F60D5B7A} - hxxps://h50203.www5.hp.com/HPISWeb/Customer/cabs/HPISDataManager.CAB
DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab
DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - hxxp://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
DPF: {5EFE8CB1-D095-11D1-88FC-0080C859833B} - hxxps://72.149.162.78:4343/officescan/console/ClientInstall/RemoveCtrl.cab
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1183070990781
DPF: {6F750202-1362-4815-A476-88533DE61D0C} - hxxp://www.kodakgallery.com/downloads/BUM/BUM_WIN_IE_2/axofupld.cab
DPF: {7584C670-2274-4EFB-B00B-D6AABA6D3850} - hxxps://www.taxsimple.org/tsweb/msrdp.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab
DPF: {9BBB3919-F518-4D06-8209-299FC243FC30} - hxxps://72.149.162.78:4343/SMB/console/html/root/AtxEnc.cab
DPF: {9DCD8EB7-E925-45C9-9321-8CA843FBED40} - hxxps://72.149.162.78:4343/SMB/console/html/root/AtxConsole.cab
DPF: {A1B8A30B-8AAA-4A3E-8869-1DA509E8A011} - hxxps://reports.igrs-ips.com/crystalreportviewers10/ActiveXControls/ActiveXViewer.cab
DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - hxxp://download.mcafee.com/molbin/shared/mcgdmgr/1,0,0,26/mcgdmgr.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab
DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} - hxxp://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: igfxcui - igfxsrvc.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

============= SERVICES / DRIVERS ===============

R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\nis\1105000.07f\symds.sys [2010-3-8 328752]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\nis\1105000.07f\symefa.sys [2010-3-8 172592]
R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2010-1-12 11608]
R1 BHDrvx86;BHDrvx86;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nis_17.1.0.19\definitions\bashdefs\20100324.001\BHDrvx86.sys [2010-3-24 536112]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\nis\1105000.07f\cchpx86.sys [2010-3-8 501888]
R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\nis\1105000.07f\ironx86.sys [2010-3-8 116272]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2010-1-12 135336]
R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2010-1-12 267432]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2010-1-12 60936]
R2 NIS;Norton Internet Security;c:\program files\norton internet security\engine\17.5.0.127\ccsvchst.exe [2010-3-8 126392]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2010-3-31 102448]
R3 IDSxpx86;IDSxpx86;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nis_17.1.0.19\definitions\ipsdefs\20100326.001\IDSXpx86.sys [2010-3-26 329592]
R3 NAVENG;NAVENG;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nis_17.1.0.19\definitions\virusdefs\20100401.032\NAVENG.SYS [2010-4-2 84912]
R3 NAVEX15;NAVEX15;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nis_17.1.0.19\definitions\virusdefs\20100401.032\NAVEX15.SYS [2010-4-2 1324720]
R3 PTUMWBus;PANTECH USB Modem V2 Composite Device Driver;c:\windows\system32\drivers\PTUMWBus.sys [2010-1-13 54416]
R3 PTUMWCSP;PANTECH USB Modem V2 Connection Port;c:\windows\system32\drivers\PTUMWCSP.sys [2010-1-13 160400]
R3 PTUMWFLT;PTUMWNET Filter Driver;c:\windows\system32\drivers\PTUMWFLT.sys [2010-1-13 12048]
R3 PTUMWMdm;PANTECH USB Modem V2 Modem Driver;c:\windows\system32\drivers\PTUMWMdm.sys [2010-1-13 160400]
R3 PTUMWNET;PANTECH USB Modem V2 WWAN Driver;c:\windows\system32\drivers\PTUMWNET.sys [2010-1-13 114192]
R3 PTUMWNSP;PANTECH USB Modem V2 NMEA Port;c:\windows\system32\drivers\PTUMWNSP.sys [2010-1-13 160400]
R3 PTUMWVsp;PANTECH USB Modem V2 Diagnostic Port;c:\windows\system32\drivers\PTUMWVsp.sys [2010-1-13 160400]
R3 SMSIVZAM5;SMSIVZAM5 NDIS Protocol Driver;c:\progra~1\verizo~1\vzacce~1\SMSIVZAM5.SYS [2009-3-20 32408]
RUnknown TmPreFilter;TmPreFilter; [x]
S3 getPlusHelper;getPlus® Helper;c:\windows\system32\svchost.exe -k getPlusHelper [2004-8-4 14336]
S3 PTDMBus;PANTECH USB Modem Composite Device Driver ;c:\windows\system32\drivers\ptdmbus.sys –> c:\windows\system32\drivers\PTDMBus.sys [?]
S3 PTDMMdm;PANTECH USB Modem Drivers ;c:\windows\system32\drivers\ptdmmdm.sys –> c:\windows\system32\drivers\PTDMMdm.sys [?]
S3 PTDMVsp;PANTECH USB Modem Serial Port ;c:\windows\system32\drivers\ptdmvsp.sys –> c:\windows\system32\drivers\PTDMVsp.sys [?]
S3 PTDMWWAN;PANTECH USB Modem WWAN Driver;c:\windows\system32\drivers\ptdmwwan.sys –> c:\windows\system32\drivers\PTDMWWAN.sys [?]

=============== Created Last 30 ================

2010-03-31 20:54 –d—– c:\docume~1\stepha~1\applic~1\Avira
2010-03-30 18:55 73,728 a——- c:\windows\system32\javacpl.cpl
2010-03-17 21:29 –d—– c:\docume~1\stepha~1\applic~1\Tific
2010-03-17 10:46 3,245 a——- c:\windows\system32\wbem\Outlook_01cac5e0ac640464.mof
2010-03-17 09:44 3,558,912 ——– c:\windows\system32\dllcache\moviemk.exe
2010-03-08 10:31 3,653 a——- c:\windows\cfgspyps.ini
2010-03-08 10:31 4,471 a——- c:\windows\cfgps.ini
2010-03-07 22:12 60,808 a——- c:\windows\system32\S32EVNT1.DLL
2010-03-07 22:12 124,976 a——- c:\windows\system32\drivers\SYMEVENT.SYS
2010-03-07 22:12 7,443 a——- c:\windows\system32\drivers\SYMEVENT.CAT
2010-03-07 22:12 805 a——- c:\windows\system32\drivers\SYMEVENT.INF
2010-03-07 22:12 –d—– c:\program files\Symantec
2010-03-07 22:12 –d—– c:\program files\common files\Symantec Shared
2010-03-07 22:10 –d—– c:\windows\system32\drivers\NIS
2010-03-07 22:10 –d—– c:\program files\Norton Internet Security
2010-03-07 22:09 –d—– c:\program files\NortonInstaller

==================== Find3M ====================

2010-04-02 00:10 0 a——- c:\windows\system32\drivers\lvuvc.hs
2010-04-02 00:10 0 a——- c:\windows\system32\drivers\logiflt.iad
2010-03-30 18:59 411,368 a——- c:\windows\system32\deploytk.dll
2010-02-25 11:54 11,070,976 ——– c:\windows\system32\dllcache\ieframe.dll
2010-02-24 05:54 173,056 ——– c:\windows\system32\dllcache\ie4uinit.exe
2010-02-17 16:17 21,704 a——- c:\windows\system32\dopdfmn7.dll
2010-02-17 16:17 18,632 a——- c:\windows\system32\dopdfmi7.dll
2010-02-16 13:24 60,936 a——- c:\windows\system32\drivers\avgntflt.sys
2010-02-05 15:00 1,700,352 a——- c:\windows\system32\GdiPlus.dll
2010-02-01 20:05 87,608 a——- c:\docume~1\stepha~1\applic~1\inst.exe
2010-02-01 20:05 47,360 a——- c:\windows\system32\drivers\pcouffin.sys
2010-02-01 20:05 47,360 a——- c:\docume~1\stepha~1\applic~1\pcouffin.sys
2008-10-28 20:00 32,768 a–sh— c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008102820081029\index.dat

============= FINISH: 0:41:00.48 ===============

ComboFix 10-04-01.02 - Stephany Turner 04/02/2010 9:44.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.766.332 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
AV: Norton Internet Security *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security *disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Stephany Turner\Application Data\inst.exe
c:\documents and settings\Stephany Turner\My Documents\ZbThumbnail.info
c:\windows\AppPatch\AcAdProc.dll
c:\windows\Downloaded Program Files\ODCTOOLS
c:\windows\ModemLog_PANTECH USB Modem .txt

.
((((((((((((((((((((((((( Files Created from 2010-03-02 to 2010-04-02 )))))))))))))))))))))))))))))))
.

2010-04-02 04:31 . 2010-04-02 04:31 ——– d—–w- c:\program files\ERUNT
2010-04-01 00:54 . 2010-04-01 00:54 ——– d—–w- c:\documents and settings\Stephany Turner\Application Data\Avira
2010-03-18 01:29 . 2010-03-18 01:29 ——– d—–w- c:\documents and settings\Stephany Turner\Application Data\Tific
2010-03-17 13:44 . 2009-10-23 15:28 3558912 ——w- c:\windows\system32\dllcache\moviemk.exe
2010-03-08 02:12 . 2010-03-08 02:12 60808 —-a-w- c:\windows\system32\S32EVNT1.DLL
2010-03-08 02:12 . 2010-03-08 02:12 124976 —-a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2010-03-08 02:12 . 2010-03-08 02:21 ——– d—–w- c:\program files\Common Files\Symantec Shared
2010-03-08 02:12 . 2010-03-08 02:12 ——– d—–w- c:\program files\Symantec
2010-03-08 02:10 . 2010-03-09 17:01 ——– d—–w- c:\windows\system32\drivers\NIS
2010-03-08 02:10 . 2010-03-08 02:10 ——– d—–w- c:\program files\Norton Internet Security
2010-03-08 02:09 . 2010-03-08 02:09 ——– d—–w- c:\program files\NortonInstaller
2010-03-08 00:15 . 2010-03-08 00:15 ——– d—–w- c:\program files\Windows Sidebar

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-02 13:58 . 2010-02-20 18:13 0 —-a-w- c:\windows\system32\drivers\lvuvc.hs
2010-04-02 13:58 . 2010-02-20 18:11 0 —-a-w- c:\windows\system32\drivers\logiflt.iad
2010-04-02 12:59 . 2010-01-07 13:25 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-04-02 12:58 . 2010-02-10 14:35 5918776 —-a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-03-31 16:17 . 2005-04-14 07:24 ——– d—–w- c:\program files\Java
2010-03-31 15:44 . 2010-02-20 18:43 ——– d—–r- c:\program files\Skype
2010-03-30 23:12 . 2006-08-15 12:52 ——– d—–w- c:\program files\Common Files\Java
2010-03-30 22:59 . 2009-03-22 23:39 411368 —-a-w- c:\windows\system32\deploytk.dll
2010-03-30 04:46 . 2010-01-07 13:25 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-30 04:45 . 2010-01-07 13:25 20824 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-03-29 14:07 . 2005-12-23 16:15 ——– d—–w- c:\program files\epson
2010-03-29 14:07 . 2005-04-14 07:25 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-03-24 20:38 . 2010-03-24 20:38 536112 —-a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\BASHDefs\20100324.001\BHDrvx86.sys
2010-03-24 20:38 . 2010-03-24 20:38 201616 —-a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\BASHDefs\20100324.001\BHRules.dll
2010-03-24 20:38 . 2010-03-24 20:38 1407888 —-a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\BASHDefs\20100324.001\BHEngine.dll
2010-03-24 20:38 . 2010-03-24 20:38 678960 —-a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\BASHDefs\20100324.001\BHDrvx64.sys
2010-03-24 20:38 . 2010-03-24 20:38 611216 —-a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\BASHDefs\20100324.001\bbRGen.dll
2010-03-18 01:29 . 2010-03-08 02:11 968560 —-a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\OCS\hsplayer.dll
2010-03-08 13:47 . 2010-04-02 12:10 1324720 —-a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\VirusDefs\20100401.038\NAVEX15.SYS
2010-03-08 13:47 . 2010-04-02 12:10 84912 —-a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\VirusDefs\20100401.038\NAVENG.SYS
2010-03-08 13:47 . 2010-04-02 12:10 102448 —-a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\VirusDefs\20100401.038\ERASER.SYS
2010-03-08 13:47 . 2010-04-02 12:10 177520 —-a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\VirusDefs\20100401.038\NAVENG32.DLL
2010-03-08 13:47 . 2010-04-02 12:10 1647984 —-a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\VirusDefs\20100401.038\NAVEX32A.DLL
2010-03-08 13:47 . 2010-04-02 12:10 371248 —-a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\VirusDefs\20100401.038\EECTRL.SYS
2010-03-08 13:47 . 2010-04-02 12:10 259440 —-a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\VirusDefs\20100401.038\ECMSVR32.DLL
2010-03-08 13:47 . 2010-04-02 12:10 2747440 —-a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\VirusDefs\20100401.038\CCERASER.DLL
2010-03-08 02:13 . 2010-01-12 17:37 ——– d—–w- c:\documents and settings\All Users\Application Data\Norton
2010-03-08 02:12 . 2010-03-08 02:12 805 —-a-w- c:\windows\system32\drivers\SYMEVENT.INF
2010-03-08 02:12 . 2010-03-08 02:12 7443 —-a-w- c:\windows\system32\drivers\SYMEVENT.CAT
2010-03-05 19:49 . 2010-02-20 18:46 ——– d—–w- c:\documents and settings\Stephany Turner\Application Data\Skype
2010-03-05 15:11 . 2010-02-20 18:52 ——– d—–w- c:\documents and settings\Stephany Turner\Application Data\skypePM
2010-03-02 21:36 . 2008-12-14 03:09 ——– d—–w- c:\program files\iTunes
2010-03-02 21:33 . 2006-04-30 01:46 ——– d—–w- c:\program files\iPod
2010-03-02 21:33 . 2007-11-24 05:09 ——– d—–w- c:\program files\Common Files\Apple
2010-03-02 21:17 . 2010-03-02 21:15 ——– d—–w- c:\program files\QuickTime
2010-03-02 20:51 . 2010-03-02 20:51 72488 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.3.15\SetupAdmin.exe
2010-03-02 04:11 . 2010-03-02 04:11 ——– d—–w- c:\windows\system32\config\systemprofile\Application Data\Softland
2010-03-01 15:42 . 2010-01-05 23:10 ——– d—–w- c:\documents and settings\Stephany Turner\Application Data\U3
2010-03-01 15:04 . 2010-03-01 15:04 ——– d—–w- c:\documents and settings\LocalService\Application Data\Softland
2010-03-01 15:04 . 2010-03-01 15:04 ——– d—–w- c:\documents and settings\Stephany Turner\Application Data\Softland
2010-03-01 15:03 . 2010-03-01 15:03 ——– d—–w- c:\program files\Softland
2010-03-01 13:05 . 2010-01-12 21:33 124784 —-a-w- c:\windows\system32\drivers\avipbb.sys
2010-02-27 21:27 . 2010-02-27 21:27 ——– d—–w- c:\documents and settings\All Users\Application Data\FLEXnet
2010-02-25 06:24 . 2004-08-04 10:00 916480 —-a-w- c:\windows\system32\wininet.dll
2010-02-23 01:50 . 2010-02-23 01:50 48680 —-a-w- c:\documents and settings\Stephany Turner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-02-22 15:18 . 2010-02-22 15:18 ——– d—–w- c:\documents and settings\Stephany Turner\Application Data\Logitech
2010-02-22 13:42 . 2010-02-22 13:42 ——– d—–w- c:\program files\Microsoft CAPICOM 2.1.0.2
2010-02-20 19:45 . 2010-02-20 18:08 ——– d—–w- c:\program files\Logitech
2010-02-20 18:52 . 2010-02-20 18:52 56 —ha-w- c:\windows\system32\ezsidmv.dat
2010-02-20 18:44 . 2010-02-20 18:44 ——– d—–w- c:\program files\Common Files\Skype
2010-02-20 18:43 . 2010-02-20 18:43 ——– d—–w- c:\documents and settings\All Users\Application Data\Skype
2010-02-20 18:25 . 2010-02-20 18:08 ——– d—–w- c:\documents and settings\All Users\Application Data\LogiShrd
2010-02-20 18:13 . 2010-02-20 18:08 ——– d—–w- c:\program files\Common Files\LogiShrd
2010-02-20 01:46 . 2010-02-20 01:46 ——– d—–w- c:\program files\Windows Media Connect 2
2010-02-17 20:17 . 2010-03-01 15:03 21704 —-a-w- c:\windows\system32\dopdfmn7.dll
2010-02-17 20:17 . 2010-03-01 15:03 18632 —-a-w- c:\windows\system32\dopdfmi7.dll
2010-02-16 17:24 . 2010-01-12 21:33 60936 —-a-w- c:\windows\system32\drivers\avgntflt.sys
2010-02-15 20:33 . 2009-12-29 17:37 1 —-a-w- c:\documents and settings\Stephany Turner\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-02-05 19:00 . 2010-03-01 15:03 1700352 —-a-w- c:\windows\system32\GdiPlus.dll
2010-02-02 01:16 . 2010-02-02 00:04 ——– d—–w- c:\program files\DVDFab 6
2010-02-02 01:06 . 2010-02-02 01:06 ——– d—–w- c:\documents and settings\All Users\Application Data\vsosdk
2010-02-02 00:06 . 2010-02-02 00:05 ——– d—–w- c:\documents and settings\Stephany Turner\Application Data\Vso
2010-02-02 00:05 . 2010-02-02 00:05 47360 —-a-w- c:\windows\system32\drivers\pcouffin.sys
2010-02-02 00:05 . 2010-02-02 00:05 47360 —-a-w- c:\documents and settings\Stephany Turner\Application Data\pcouffin.sys
2010-02-02 00:05 . 2010-02-02 00:05 47360 —-a-w- c:\documents and settings\Stephany Turner\Application Data\pcouffin.sys
2010-01-28 15:07 . 2010-01-28 15:07 348160 —-a-w- c:\documents and settings\Stephany Turner\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-2a998b41-n\msvcr71.dll
2010-01-28 15:07 . 2010-01-28 15:07 503808 —-a-w- c:\documents and settings\Stephany Turner\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-2a998b41-n\msvcp71.dll
2010-01-28 15:07 . 2010-01-28 15:07 499712 —-a-w- c:\documents and settings\Stephany Turner\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-2a998b41-n\jmc.dll
2010-01-28 15:07 . 2010-01-28 15:07 61440 —-a-w- c:\documents and settings\Stephany Turner\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-6e7b25e4-n\decora-sse.dll
2010-01-28 15:07 . 2010-01-28 15:07 12800 —-a-w- c:\documents and settings\Stephany Turner\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-6e7b25e4-n\decora-d3d.dll
2010-01-27 18:26 . 2009-01-23 22:18 38784 —-a-w- c:\documents and settings\Stephany Turner\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-01-06 13:41 . 2010-01-06 13:35 29256488 —-a-w- c:\documents and settings\Stephany Turner\Application Data\Smith Micro\Updates\VZAM_7.2.1_2420b_Pantech_UM190.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-11-11 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-02-15 141608]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-23 39264]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2008-04-14 53760]

c:\documents and settings\Stephany Turner\Start Menu\Programs\Startup\AutorunsDisabled
Logitech . Product Registration.lnk - c:\program files\Logitech\Logitech WebCam Software\eReg.exe [2009-10-14 517384]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\SYSTEM32\\mmc.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 SymDS;Symantec Data Store;c:\windows\SYSTEM32\DRIVERS\NIS\1105000.07F\symds.sys [3/8/2010 2:49 PM 328752]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\SYSTEM32\DRIVERS\NIS\1105000.07F\symefa.sys [3/8/2010 2:49 PM 172592]
R1 BHDrvx86;BHDrvx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\BASHDefs\20100324.001\BHDrvx86.sys [3/24/2010 4:38 PM 536112]
R1 ccHP;Symantec Hash Provider;c:\windows\SYSTEM32\DRIVERS\NIS\1105000.07F\cchpx86.sys [3/8/2010 2:49 PM 501888]
R1 SymIRON;Symantec Iron Driver;c:\windows\SYSTEM32\DRIVERS\NIS\1105000.07F\ironx86.sys [3/8/2010 2:49 PM 116272]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [1/12/2010 5:32 PM 135336]
R2 NIS;Norton Internet Security;c:\program files\Norton Internet Security\Engine\17.5.0.127\ccsvchst.exe [3/8/2010 2:48 PM 126392]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [3/31/2010 8:52 AM 102448]
R3 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\IPSDefs\20100326.001\IDSXpx86.sys [3/26/2010 2:20 PM 329592]
S3 PTDMBus;PANTECH USB Modem Composite Device Driver ;c:\windows\system32\DRIVERS\PTDMBus.sys –> c:\windows\system32\DRIVERS\PTDMBus.sys [?]
S3 PTDMMdm;PANTECH USB Modem Drivers ;c:\windows\system32\DRIVERS\PTDMMdm.sys –> c:\windows\system32\DRIVERS\PTDMMdm.sys [?]
S3 PTDMVsp;PANTECH USB Modem Serial Port ;c:\windows\system32\DRIVERS\PTDMVsp.sys –> c:\windows\system32\DRIVERS\PTDMVsp.sys [?]
S3 PTDMWWAN;PANTECH USB Modem WWAN Driver;c:\windows\system32\DRIVERS\PTDMWWAN.sys –> c:\windows\system32\DRIVERS\PTDMWWAN.sys [?]
S3 PTUMWBus;PANTECH USB Modem V2 Composite Device Driver;c:\windows\SYSTEM32\DRIVERS\PTUMWBus.sys [1/13/2010 5:09 PM 54416]
S3 PTUMWCSP;PANTECH USB Modem V2 Connection Port;c:\windows\SYSTEM32\DRIVERS\PTUMWCSP.sys [1/13/2010 5:09 PM 160400]
S3 PTUMWFLT;PTUMWNET Filter Driver;c:\windows\SYSTEM32\DRIVERS\PTUMWFLT.sys [1/13/2010 5:09 PM 12048]
S3 PTUMWMdm;PANTECH USB Modem V2 Modem Driver;c:\windows\SYSTEM32\DRIVERS\PTUMWMdm.sys [1/13/2010 5:09 PM 160400]
S3 PTUMWNET;PANTECH USB Modem V2 WWAN Driver;c:\windows\SYSTEM32\DRIVERS\PTUMWNET.sys [1/13/2010 5:09 PM 114192]
S3 PTUMWNSP;PANTECH USB Modem V2 NMEA Port;c:\windows\SYSTEM32\DRIVERS\PTUMWNSP.sys [1/13/2010 5:09 PM 160400]
S3 PTUMWVsp;PANTECH USB Modem V2 Diagnostic Port;c:\windows\SYSTEM32\DRIVERS\PTUMWVsp.sys [1/13/2010 5:09 PM 160400]
S3 SMSIVZAM5;SMSIVZAM5 NDIS Protocol Driver;c:\progra~1\VERIZO~1\VZACCE~1\SMSIVZAM5.SYS [3/20/2009 8:03 PM 32408]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
Contents of the 'Scheduled Tasks' folder

2010-03-29 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

2010-04-02 c:\windows\Tasks\User_Feed_Synchronization-{0B4609AE-D210-40B9-A695-290751EA2148}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 08:31]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.usatoday.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
DPF: {119CE688-A7E9-1941-8E10-F42990BBA4C4} - hxxps://fiserv.assurity.com/reports/control/ASRrptview.cab
DPF: {9BBB3919-F518-4D06-8209-299FC243FC30} - hxxps://72.149.162.78:4343/SMB/console/html/root/AtxEnc.cab
DPF: {9DCD8EB7-E925-45C9-9321-8CA843FBED40} - hxxps://72.149.162.78:4343/SMB/console/html/root/AtxConsole.cab
DPF: {A1B8A30B-8AAA-4A3E-8869-1DA509E8A011} - hxxps://reports.igrs-ips.com/crystalreportviewers10/ActiveXControls/ActiveXViewer.cab
.
- - - - ORPHANS REMOVED - - - -

Toolbar-Locked - (no file)
HKU-Default-Run-Photo TurboBackup - c:\progra~1\FILEST~1\PHOTOT~1\pbksche.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-02 10:00
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NIS]
"ImagePath"="\"c:\program files\Norton Internet Security\Engine\17.5.0.127\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files\Norton Internet Security\Engine\17.5.0.127\diMaster.dll\" /prefetch:1"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'explorer.exe'(2268)
c:\windows\system32\WININET.dll
c:\windows\TEMP\logishrd\LVPrcInj01.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\program files\Ahead\InCD\InCDsrv.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Canon\CAL\CALMAIN.exe
c:\windows\system32\wscntfy.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2010-04-02 10:12:44 - machine was rebooted
ComboFix-quarantined-files.txt 2010-04-02 14:12

Pre-Run: 18,887,245,824 bytes free
Post-Run: 18,864,185,344 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

- - End Of File - - 4180E1292F6C5F48AFAC94DF48845F55