What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

MSIE Java Deployment Toolkit Input Invaidation and HTTP Neosploit Aciv

12 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi,

My Norton 360 product informed me of a MSIE Java Deployment Toolkit Input Invalidation intrusion today and cheking my history I had a HTTP Neospoilt Acivity 3 intrusion in March. My computer is also slow on start up and shut down, as is my browser. My concern is that my computer may be compromised.

Here are my MBR Check, DDS and GMER logs. I kept my antivirus shut down for all of the scans.

MBRCheck, version 1.2.3
© 2010, AD

Command-line:
Windows Version: Windows XP Home Edition
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x0000000c

Kernel Drivers (total 138):
0x804D7000 \WINDOWS\system32\ntkrnlpa.exe
0x806D0000 \WINDOWS\system32\hal.dll
0xF7987000 \WINDOWS\system32\KDCOM.DLL
0xF7897000 \WINDOWS\system32\BOOTVID.dll
0xF7358000 ACPI.sys
0xF7989000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xF7347000 pci.sys
0xF7487000 isapnp.sys
0xF7497000 ohci1394.sys
0xF74A7000 \WINDOWS\system32\DRIVERS\1394BUS.SYS
0xF789B000 compbatt.sys
0xF789F000 \WINDOWS\system32\DRIVERS\BATTC.SYS
0xF7A4F000 pciide.sys
0xF7707000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
0xF798B000 intelide.sys
0xF798D000 viaide.sys
0xF798F000 aliide.sys
0xF7329000 pcmcia.sys
0xF74B7000 MountMgr.sys
0xF730A000 ftdisk.sys
0xF78A3000 ACPIEC.sys
0xF7A50000 \WINDOWS\system32\DRIVERS\OPRGHDLR.SYS
0xF770F000 PartMgr.sys
0xF74C7000 VolSnap.sys
0xF72F2000 atapi.sys
0xF74D7000 disk.sys
0xF74E7000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xF72D2000 fltmgr.sys
0xF72C0000 sr.sys
0xF7271000 SYMEFA.SYS
0xF74F7000 PxHelp20.sys
0xF725A000 KSecDD.sys
0xF71CD000 Ntfs.sys
0xF71A0000 NDIS.sys
0xF7507000 serial.sys
0xF7186000 Mup.sys
0xF6C9D000 \SystemRoot\system32\DRIVERS\intelppm.sys
0xF796F000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
0xF6B4F000 \SystemRoot\system32\DRIVERS\ialmnt5.sys
0xF6B3B000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xF7817000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0xF6B17000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xF781F000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xF696F000 \SystemRoot\system32\DRIVERS\bcmwl5.sys
0xF695D000 \SystemRoot\system32\DRIVERS\Rtlnicxp.sys
0xF6927000 \SystemRoot\system32\drivers\smwdm.sys
0xF6903000 \SystemRoot\system32\drivers\portcls.sys
0xF6C8D000 \SystemRoot\system32\drivers\drmk.sys
0xF68E0000 \SystemRoot\system32\drivers\ks.sys
0xF68C0000 \SystemRoot\system32\drivers\aeaudio.sys
0xF6860000 \SystemRoot\system32\drivers\senfilt.sys
0xF675B000 \SystemRoot\system32\DRIVERS\AGRSM.sys
0xF7827000 \SystemRoot\System32\Drivers\Modem.SYS
0xF797B000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0xF6C6D000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0xF782F000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xF6741000 \SystemRoot\system32\DRIVERS\Apfiltr.sys
0xF7837000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xF6C5D000 \SystemRoot\system32\DRIVERS\imapi.sys
0xF783F000 \SystemRoot\system32\drivers\Afc.sys
0xF6C4D000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xF6C3D000 \SystemRoot\system32\DRIVERS\redbook.sys
0xF7847000 \SystemRoot\SYSTEM32\DRIVERS\GEARAspiWDM.sys
0xF7B4F000 \SystemRoot\system32\DRIVERS\audstub.sys
0xF6C2D000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xF7151000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xF6702000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xF6C1D000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xF6C0D000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xF784F000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xF66B2000 \SystemRoot\system32\DRIVERS\psched.sys
0xF75C7000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xF785F000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xF7867000 \SystemRoot\system32\DRIVERS\raspti.sys
0xF75D7000 \SystemRoot\system32\DRIVERS\termdd.sys
0xF786F000 \SystemRoot\system32\DRIVERS\SymIM.sys
0xF79D1000 \SystemRoot\system32\DRIVERS\swenum.sys
0xF6654000 \SystemRoot\system32\DRIVERS\update.sys
0xF7139000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xF75E7000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xF7617000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xF79D5000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xF79DF000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xF7ACF000 \SystemRoot\System32\Drivers\Null.SYS
0xF79E1000 \SystemRoot\System32\Drivers\Beep.SYS
0xF7887000 \SystemRoot\System32\drivers\vga.sys
0xF79E3000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xF79E5000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xF788F000 \SystemRoot\System32\Drivers\Msfs.SYS
0xF7727000 \SystemRoot\System32\Drivers\Npfs.SYS
0xF7953000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xA9ACD000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xA9A74000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xA9A40000 \SystemRoot\System32\Drivers\N360\0308000.029\SYMTDI.SYS
0xA9A1B000 \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS
0xA99CD000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xF7627000 \SystemRoot\system32\DRIVERS\wanarp.sys
0xF773F000 \SystemRoot\System32\Drivers\N360\0308000.029\SYMNDIS.SYS
0xA99B8000 \SystemRoot\System32\Drivers\N360\0308000.029\SYMFW.SYS
0xF7747000 \SystemRoot\System32\Drivers\N360\0308000.029\SYMIDS.SYS
0xA98A4000 \SystemRoot\system32\DRIVERS\netbt.sys
0xA9882000 \SystemRoot\System32\drivers\afd.sys
0xF7687000 \SystemRoot\system32\DRIVERS\netbios.sys
0xF7767000 \SystemRoot\System32\Drivers\StarOpen.SYS
0xF7697000 \SystemRoot\system32\drivers\N360\0308000.029\SRTSPX.SYS
0xA97B7000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xA9747000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xF76A7000 \SystemRoot\System32\Drivers\Fips.SYS
0xA96D6000 \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys
0xA969C000 \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
0xF7A09000 \??\C:\WINDOWS\system32\drivers\EABFiltr.sys
0xA9621000 \SystemRoot\System32\Drivers\N360\0308000.029\ccHPx86.sys
0xA95DF000 \SystemRoot\System32\Drivers\N360\0308000.029\BHDrvx86.sys
0xF6C7D000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xA9527000 \SystemRoot\System32\Drivers\dump_atapi.sys
0xF7A23000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xA9A0F000 \SystemRoot\System32\drivers\Dxapi.sys
0xF77BF000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xF7B90000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF020000 \SystemRoot\System32\ialmdnt5.dll
0xBF012000 \SystemRoot\System32\ialmrnt5.dll
0xBF03F000 \SystemRoot\System32\ialmdev5.DLL
0xBF068000 \SystemRoot\System32\ialmdd5.DLL
0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
0xF6648000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xA9202000 \SystemRoot\system32\DRIVERS\mrxdav.sys
0xA8FF3000 \SystemRoot\system32\DRIVERS\srv.sys
0xA8B2E000 \SystemRoot\system32\drivers\wdmaud.sys
0xA8C63000 \SystemRoot\system32\drivers\sysaudio.sys
0xA86EF000 \SystemRoot\System32\Drivers\N360\0308000.029\SRTSP.SYS
0xA7FAE000 \SystemRoot\System32\Drivers\HTTP.sys
0xA78AE000 \??\C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\ipsdefs\20100805.004\IDSxpx86.sys
0xA75A7000 \??\C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100806.002\NAVEX15.SYS
0xA7593000 \??\C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100806.002\NAVENG.SYS
0xA7515000 \SystemRoot\system32\drivers\kmixer.sys
0x7C900000 \WINDOWS\system32\ntdll.dll

Processes (total 56):
0 System Idle Process
4 System
976 C:\WINDOWS\system32\smss.exe
1032 csrss.exe
1056 C:\WINDOWS\system32\winlogon.exe
1100 C:\WINDOWS\system32\services.exe
1112 C:\WINDOWS\system32\lsass.exe
1260 C:\WINDOWS\system32\svchost.exe
1336 svchost.exe
1396 C:\WINDOWS\system32\svchost.exe
1528 svchost.exe
1624 svchost.exe
1916 C:\WINDOWS\system32\LEXBCES.EXE
1952 C:\WINDOWS\system32\spoolsv.exe
1956 C:\WINDOWS\system32\LEXPPS.EXE
184 svchost.exe
208 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
228 C:\Program Files\Bonjour\mDNSResponder.exe
260 C:\Program Files\Flip Video\FlipShare\FlipShareService.exe
296 C:\WINDOWS\system32\svchost.exe
316 C:\Program Files\Java\jre6\bin\jqs.exe
344 C:\Program Files\Common Files\LightScribe\LSSrvc.exe
444 C:\Program Files\Norton 360\Engine\3.8.0.41\ccSvcHst.exe
592 C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
640 C:\WINDOWS\system32\svchost.exe
928 C:\Program Files\Canon\CAL\CALMAIN.exe
1840 alg.exe
1844 unsecapp.exe
1676 wmiprvse.exe
3024 C:\WINDOWS\explorer.exe
476 C:\Program Files\Norton 360\Engine\3.8.0.41\ccSvcHst.exe
1728 C:\WINDOWS\system32\igfxtray.exe
1836 C:\WINDOWS\system32\hkcmd.exe
2156 C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
2192 C:\Program Files\Apoint2K\Apoint.exe
2236 C:\Program Files\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe
2268 C:\Program Files\Apoint2K\ApntEx.exe
2388 wmiprvse.exe
2588 C:\Program Files\HPQ\Quick Launch Buttons\eabservr.exe
2760 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
2796 C:\WINDOWS\AGRSMMSG.exe
2904 C:\WINDOWS\system32\LXSUPMON.EXE
2968 C:\Program Files\Hp\HP Software Update\hpwuschd2.exe
3272 C:\Program Files\Common Files\Java\Java Update\jusched.exe
3284 C:\Program Files\iTunes\iTunesHelper.exe
3296 C:\Program Files\Windows Live\Messenger\msnmsgr.exe
3312 C:\WINDOWS\system32\ctfmon.exe
3332 C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe
3340 C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe
3744 C:\Program Files\Hp\Digital Imaging\bin\hpqste08.exe
3792 C:\Program Files\Hp\Digital Imaging\bin\hpqbam08.exe
3828 C:\Program Files\Hp\Digital Imaging\bin\hpqgpc01.exe
2544 C:\Program Files\HPQ\Shared\hpqwmi.exe
2664 C:\Program Files\iPod\bin\iPodService.exe
4052 C:\WINDOWS\system32\wscntfy.exe
2564 C:\Documents and Settings\Scott Mills\Desktop\MBRCheck.exe

\\.\C: –> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)

PhysicalDrive0 Model Number: ST9402113A, Rev: 3.02

Size Device Name MBR Status
——————————————–
37 GB \\.\PhysicalDrive0 Windows XP MBR code detected
SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A


Done!


DDS (Ver_10-03-17.01) - NTFSx86
Run by [removed] at 20:47:26.28 on 06/08/2010
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_21
Microsoft Windows XP Home Edition 5.1.2600.3.1252.44.1033.18.1270.634 [GMT 1:00]

AV: Norton 360 *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton 360 *disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Flip Video\FlipShare\FlipShareService.exe
C:\WINDOWS\system32\svchost.exe -k hpdevmgmt
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Norton 360\Engine\3.8.0.41\ccSvcHst.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Norton 360\Engine\3.8.0.41\ccSvcHst.exe
C:\WINDOWS\system32\igfxtray.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\LXSUPMON.EXE
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe
C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Program Files\HPQ\SHARED\HPQWMI.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\Scott Mills\Desktop\dds.com

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.tiscali.co.uk/
uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_GB&c=Q305&bd=presario&pf=laptop
uInternet Settings,ProxyOverride = *.local
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Symantec NCO BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - c:\program files\norton 360\engine\3.8.0.41\coIEPlg.dll
BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\program files\norton 360\engine\3.8.0.41\IPSBHO.DLL
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - c:\program files\norton 360\engine\3.8.0.41\coIEPlg.dll
EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - c:\program files\hp\digital imaging\smart web printing\hpswp_bho.dll
uRun: [MsnMsgr] "c:\program files\windows live\messenger\MsnMsgr.Exe" /background
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [SoundMAXPnP] c:\program files\analog devices\soundmax\SMax4PNP.exe
mRun: [Apoint] c:\program files\apoint2k\Apoint.exe
mRun: [hpWirelessAssistant] c:\program files\hpq\hp wireless assistant\HP Wireless Assistant.exe
mRun: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
mRun: [eabconfg.cpl] c:\program files\hpq\quick launch buttons\EabServr.exe /Start
mRun: [Cpqset] c:\program files\hpq\default settings\cpqset.exe
mRun: [RemoteControl] "c:\program files\cyberlink\powerdvd\PDVDServ.exe"
mRun: [AGRSMMSG] AGRSMMSG.exe
mRun: [LXSUPMON] c:\windows\system32\LXSUPMON.EXE RUN
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\device~1.lnk - c:\program files\olympus\devicedetector\DevDtct2.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office11\REFIEBAR.DLL
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://a1540.g.akamai.net/7/1540/52/20061205/qtinstall.info.apple.com/qtactivex/qtplugin.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/5/b/0/5b0d4654-aa20-495c-b89f-c1c34c691085/LegitCheckControl.cab
DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab
DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab
DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} - hxxps://webdl.symantec.com/activex/symdlmgr.cab
DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} - hxxps://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} - hxxp://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} - hxxp://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: symres - {AA1061FE-6C41-421f-9344-69640C9732AB} - c:\program files\norton 360\engine\3.8.0.41\CoIEPlg.dll
Notify: igfxcui - igfxsrvc.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
mASetup: {A509B1FF-37FF-4bFF-8CFF-4F3A747040FF} - c:\windows\system32\rundll32.exe c:\windows\system32\advpack.dll,launchinfsectionex c:\program files\internet explorer\clrtour.inf,DefaultInstall.ResetTour,,12

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\scottm~1\applic~1\mozilla\firefox\profiles\emgdb7zc.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.tiscali.co.uk/index_first.html
FF - prefs.js: network.proxy.type - 4
FF - component: c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\coffplgn\components\coFFPlgn.dll
FF - component: c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\ipsffplgn\components\IPSFFPl.dll
FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\microsoft\office live\npOLW.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}

============= SERVICES / DRIVERS ===============

R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\n360\0308000.029\SymEFA.sys [2010-2-3 310320]
R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\n360\0308000.029\BHDrvx86.sys [2010-2-3 259632]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\n360\0308000.029\cchpx86.sys [2010-2-3 482432]
R1 IDSxpx86;IDSxpx86;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\ipsdefs\20100805.004\IDSXpx86.sys [2010-8-6 331640]
R2 N360;Norton 360;c:\program files\norton 360\engine\3.8.0.41\ccSvcHst.exe [2010-2-3 117640]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2010-5-27 102448]
R3 NAVENG;NAVENG;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\virusdefs\20100806.002\NAVENG.SYS [2010-8-6 85424]
R3 NAVEX15;NAVEX15;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\virusdefs\20100806.002\NAVEX15.SYS [2010-8-6 1362608]

=============== Created Last 30 ================

2010-07-31 17:47:39 0 d—–w- c:\program files\iPod
2010-07-31 17:47:19 0 d—–w- c:\program files\iTunes
2010-07-26 13:14:44 0 d—–w- c:\program files\Flip Video
2010-07-26 13:14:43 0 d—–w- c:\docume~1\alluse~1\applic~1\Flip Video
2010-07-24 12:40:20 73728 —-a-w- c:\windows\system32\javacpl.cpl
2010-07-23 12:58:10 0 d-sha-r- C:\cmdcons
2010-07-14 11:18:55 744448 ——w- c:\windows\system32\dllcache\helpsvc.exe

==================== Find3M ====================

2010-07-27 06:30:35 8462336 ——w- c:\windows\system32\dllcache\shell32.dll
2010-07-24 12:39:40 423656 —-a-w- c:\windows\system32\deployJava1.dll
2010-05-18 15:35:16 91424 —-a-w- c:\windows\system32\dnssd.dll
2010-05-18 15:35:16 107808 —-a-w- c:\windows\system32\dns-sd.exe
2008-09-05 13:36:17 32768 -csha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008090520080906\index.dat

============= FINISH: 20:48:35.48 ===============

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-08-07 00:19:03
Windows 5.1.2600 Service Pack 3
Running: 3j50m861.exe; Driver: C:\DOCUME~1\SCOTTM~1\LOCALS~1\Temp\fxtdypow.sys


—- System - GMER 1.0.15 —-

SSDT 89CB6170 ZwAlertResumeThread
SSDT 89CA70B0 ZwAlertThread
SSDT 89CBC008 ZwAllocateVirtualMemory
SSDT 89CF2070 ZwAssignProcessToJobObject
SSDT 89CFB840 ZwConnectPort
SSDT \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwCreateKey [0xA9A31130]
SSDT 89C5F0A0 ZwCreateMutant
SSDT 89CC9008 ZwCreateSymbolicLinkObject
SSDT 89C6FA40 ZwCreateThread
SSDT 89CF2130 ZwDebugActiveProcess
SSDT \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwDeleteKey [0xA9A313B0]
SSDT \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwDeleteValueKey [0xA9A31910]
SSDT 89D73160 ZwDuplicateObject
SSDT 89C65160 ZwFreeVirtualMemory
SSDT 89C5F170 ZwImpersonateAnonymousToken
SSDT 89CB60B0 ZwImpersonateThread
SSDT 89CFF898 ZwLoadDriver
SSDT 89C65080 ZwMapViewOfSection
SSDT 89CBA170 ZwOpenEvent
SSDT 89C7CBE0 ZwOpenProcess
SSDT 89C7CA90 ZwOpenProcessToken
SSDT 89CD6170 ZwOpenSection
SSDT 89C7CB10 ZwOpenThread
SSDT 89C85120 ZwProtectVirtualMemory
SSDT 89CFA450 ZwResumeThread
SSDT 89CB5170 ZwSetContextThread
SSDT 89CB7098 ZwSetInformationProcess
SSDT 89CD6068 ZwSetSystemInformation
SSDT \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwSetValueKey [0xA9A31B60]
SSDT 89CBA0B0 ZwSuspendProcess
SSDT 89CA7170 ZwSuspendThread
SSDT 89C9F130 ZwTerminateProcess
SSDT 89CB50B0 ZwTerminateThread
SSDT 89CBC058 ZwUnmapViewOfSection
SSDT 89CBC0D8 ZwWriteVirtualMemory

—- Kernel code sections - GMER 1.0.15 —-

? SYMEFA.SYS The system cannot find the file specified. !
init C:\WINDOWS\system32\drivers\senfilt.sys entry point in "init" section [0xF68B8900]

—- Devices - GMER 1.0.15 —-

AttachedDevice \Driver\Tcpip \Device\Ip SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 EABFiltr.sys (QLB PS/2 Keyboard filter driver/Hewlett-Packard Company)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 EABFiltr.sys (QLB PS/2 Keyboard filter driver/Hewlett-Packard Company)
AttachedDevice \Driver\Tcpip \Device\Tcp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Udp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\RawIp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)

—- EOF - GMER 1.0.15 —-

Attachments:

Post #2
Hi,

Please do the following:

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
  • Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

  • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

  • Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
Post #3
Hi

ComboFix 10-08-06.03 - Scott Mills 07/08/2010 15:26:19.2.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.44.1033.18.1270.631 [GMT 1:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: Norton 360 *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton 360 *disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2010-07-07 to 2010-08-07 )))))))))))))))))))))))))))))))
.

2010-08-05 16:39 . 2010-08-05 16:39 503808 —-a-w- c:\documents and settings\Scott Mills\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-6df6c084-n\msvcp71.dll
2010-08-05 16:39 . 2010-08-05 16:39 499712 —-a-w- c:\documents and settings\Scott Mills\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-6df6c084-n\jmc.dll
2010-08-05 16:39 . 2010-08-05 16:39 348160 —-a-w- c:\documents and settings\Scott Mills\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-6df6c084-n\msvcr71.dll
2010-08-05 16:39 . 2010-08-05 16:39 61440 —-a-w- c:\documents and settings\Scott Mills\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-5ea979de-n\decora-sse.dll
2010-08-05 16:39 . 2010-08-05 16:39 12800 —-a-w- c:\documents and settings\Scott Mills\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-5ea979de-n\decora-d3d.dll
2010-07-31 17:47 . 2010-07-31 17:47 ——– d—–w- c:\program files\iPod
2010-07-31 17:47 . 2010-07-31 17:49 ——– d—–w- c:\program files\iTunes
2010-07-31 17:36 . 2010-07-31 17:36 73000 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.2.1.5\SetupAdmin.exe
2010-07-26 13:14 . 2010-07-26 13:14 ——– d—–w- c:\program files\Flip Video
2010-07-26 13:14 . 2010-07-26 13:14 ——– d—–w- c:\documents and settings\All Users\Application Data\Flip Video
2010-07-14 11:18 . 2010-06-14 14:31 744448 ——w- c:\windows\system32\dllcache\helpsvc.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-07 14:20 . 2009-10-07 14:59 ——– d—–w- c:\documents and settings\Scott Mills\Application Data\HPAppData
2010-07-31 17:47 . 2007-08-22 17:27 ——– d—–w- c:\program files\Common Files\Apple
2010-07-24 12:41 . 2005-05-20 08:34 ——– d—–w- c:\program files\Common Files\Java
2010-07-24 12:39 . 2010-04-16 17:11 423656 —-a-w- c:\windows\system32\deployJava1.dll
2010-07-24 12:31 . 2005-05-20 08:34 ——– d—–w- c:\program files\Java
2010-07-21 15:31 . 2005-05-20 08:31 ——– d—–w- c:\program files\Common Files\InstallShield
2010-07-21 15:31 . 2005-05-20 08:31 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-07-21 15:24 . 2008-10-30 15:40 ——– d—–w- c:\program files\Image-Line
2010-07-21 15:21 . 2008-10-30 15:44 ——– d—–w- c:\program files\VstPlugins
2010-06-26 17:43 . 2010-06-26 17:43 ——– d—–w- c:\program files\Bonjour
2010-06-22 11:26 . 2005-12-09 23:58 58328 —-a-w- c:\documents and settings\Scott Mills\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-06-19 11:23 . 2010-06-19 11:23 ——– d—–w- c:\program files\MSECache
2010-06-14 14:31 . 2004-08-04 08:00 744448 —-a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-05-27 07:46 . 2010-05-27 07:46 503808 —-a-w- c:\documents and settings\Scott Mills\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-6252978f-n\msvcp71.dll
2010-05-27 07:46 . 2010-05-27 07:46 61440 —-a-w- c:\documents and settings\Scott Mills\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-48e27ef7-n\decora-sse.dll
2010-05-27 07:46 . 2010-05-27 07:46 499712 —-a-w- c:\documents and settings\Scott Mills\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-6252978f-n\jmc.dll
2010-05-27 07:46 . 2010-05-27 07:46 348160 —-a-w- c:\documents and settings\Scott Mills\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-6252978f-n\msvcr71.dll
2010-05-27 07:46 . 2010-05-27 07:46 12800 —-a-w- c:\documents and settings\Scott Mills\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-48e27ef7-n\decora-d3d.dll
2010-05-18 15:35 . 2010-05-18 15:35 91424 —-a-w- c:\windows\system32\dnssd.dll
2010-05-18 15:35 . 2010-05-18 15:35 107808 —-a-w- c:\windows\system32\dns-sd.exe
2008-06-30 12:44 . 2008-09-30 11:15 324976 -c–a-w- c:\program files\mozilla firefox\components\coFFPlgn.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2009-07-26 3883856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-12-13 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-12-13 126976]
"SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 1388544]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2005-02-08 159744]
"hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2005-04-11 794624]
"LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2004-10-14 253952]
"eabconfg.cpl"="c:\program files\HPQ\Quick Launch Buttons\EabServr.exe" [2004-12-03 290816]
"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2004-09-07 213054]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-06-28 32768]
"AGRSMMSG"="AGRSMMSG.exe" [2005-11-16 88209]
"LXSUPMON"="c:\windows\system32\LXSUPMON.EXE" [2002-07-08 886272]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2010-03-12 49208]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-17 421888]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-07-21 141608]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Device Detector 3.lnk - c:\program files\Olympus\DeviceDetector\DevDtct2.exe [2009-3-6 118784]
HP Digital Imaging Monitor.lnk - c:\program files\Hp\Digital Imaging\bin\hpqtra08.exe [2009-5-21 275768]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]
@="FSFilter Activity Monitor"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\Common Files\\HP\\Digital Imaging\\Bin\\hpqPhotoCrm.exe"=
"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqgplgtupl.exe"=
"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqgpc01.exe"=
"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqusgm.exe"=
"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqusgh.exe"=
"c:\\Program Files\\Hp\\HP Software Update\\hpwucli.exe"=
"c:\\Program Files\\Hp\\Digital Imaging\\smart web printing\\SmartWebPrintExe.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360\0308000.029\SymEFA.sys [03/02/2010 19:56 310320]
R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\N360\0308000.029\BHDrvx86.sys [03/02/2010 19:56 259632]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\N360\0308000.029\cchpx86.sys [03/02/2010 19:56 482432]
R1 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100805.004\IDSXpx86.sys [06/08/2010 14:32 331640]
R2 N360;Norton 360;c:\program files\Norton 360\Engine\3.8.0.41\ccSvcHst.exe [03/02/2010 19:55 117640]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [27/05/2010 22:27 102448]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
2009-03-08 04:32 128512 —-a-w- c:\windows\system32\advpack.dll
.
Contents of the 'Scheduled Tasks' folder

2010-07-31 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2010-08-06 c:\windows\Tasks\System Restore.job
- c:\windows\system32\Restore\rstrui.exe [2004-08-04 00:12]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.tiscali.co.uk/
uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_GB&c=Q305&bd=presario&pf=laptop
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Scott Mills\Application Data\Mozilla\Firefox\Profiles\emgdb7zc.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.tiscali.co.uk/index_first.html
FF - prefs.js: network.proxy.type - 4
FF - component: c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\components\coFFPlgn.dll
FF - component: c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\IPSFFPlgn\components\IPSFFPl.dll
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-08-07 15:40
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe????????5?7?9?9??????? ???B???????????????B? ??????

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\N360]
"ImagePath"="\"c:\program files\Norton 360\Engine\3.8.0.41\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files\Norton 360\Engine\3.8.0.41\diMaster.dll\" /prefetch:1"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(1056)
c:\windows\system32\igfxsrvc.dll
c:\windows\system32\hccutils.DLL

- - - - - - - > 'explorer.exe'(3088)
c:\windows\system32\WININET.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2010-08-07 15:43:55
ComboFix-quarantined-files.txt 2010-08-07 14:43
ComboFix2.txt 2010-07-23 13:11

Pre-Run: 6,321,692,672 bytes free
Post-Run: 6,940,168,192 bytes free

- - End Of File - - BE0938D99E5B2B61155082557E209BF1
Post #4
Hi,

Please do the following:

Please download Malwarebytes' Anti-Malware
  • Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish, so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected. <– very important
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.



NEXT


Run an on-line scan with Kaspersky

Using Internet Explorer or Firefox, visit Kaspersky On-line Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.
2. To optimize scanning time and produce a more sensible report for review:
  • Close any open programs
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
3. Click Run at the Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take several minutes.
  • Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
  • Click View scan report at the bottom.

    [external image: Posted Image]
  • Click the Save as Text button to save the file to your desktop so that you may post it in your next reply
Post #5
Can I ask whether the scans so far have shown up anything? Also, in reference to your last post, am I able to use the MBAM program I already have, or do I need to download another one? Thanks
Post #6
You can use the Malwarebytes you have already, make sure you update the definitions: You posted run #2 of ComboFix, if you could locate the first log > it should be located at C:\Qoobox\ComboFix2.txt
Post #7 last edited
I posted the ComboFix text file that popped up after the scan (conducted on 8th Aug 10), why was this wrong? I see I have text files at C:\ComboFix.txt and C:\Qoobo\ComboFix2.txt and the ComboFix2 file seems to be the old one as the date on it was 23rd Jun 10.

Nevertheless, here is the ComboFix2 file. Will then run MBAM and Kerpasky.

ComboFix 10-07-22.01 - Scott Mills 23/07/2010 14:00:22.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.44.1033.18.1270.645 [GMT 1:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: Norton 360 *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton 360 *disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\xpsp1hfm.log

.
((((((((((((((((((((((((( Files Created from 2010-06-23 to 2010-07-23 )))))))))))))))))))))))))))))))
.

2010-07-14 11:18 . 2010-06-14 14:31 744448 ——w- c:\windows\system32\dllcache\helpsvc.exe
2010-07-05 15:26 . 2010-07-05 15:26 ——– d—–w- c:\program files\Flip Video
2010-06-26 17:50 . 2010-06-26 17:50 ——– d—–w- c:\program files\iPod
2010-06-26 17:50 . 2010-06-26 17:52 ——– d—–w- c:\program files\iTunes
2010-06-26 17:43 . 2010-06-26 17:43 ——– d—–w- c:\program files\Bonjour
2010-06-26 17:37 . 2010-06-26 17:37 72504 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.2.0.61\SetupAdmin.exe
2010-06-24 13:40 . 2010-06-24 13:40 ——– d—–w- c:\documents and settings\Administrator\Application Data\Malwarebytes

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-23 12:24 . 2009-10-07 14:59 ——– d—–w- c:\documents and settings\Scott Mills\Application Data\HPAppData
2010-07-21 15:31 . 2005-05-20 08:31 ——– d—–w- c:\program files\Common Files\InstallShield
2010-07-21 15:31 . 2005-05-20 08:31 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-07-21 15:24 . 2008-10-30 15:40 ——– d—–w- c:\program files\Image-Line
2010-07-21 15:21 . 2008-10-30 15:44 ——– d—–w- c:\program files\VstPlugins
2010-06-26 17:50 . 2007-08-22 17:27 ——– d—–w- c:\program files\Common Files\Apple
2010-06-22 11:26 . 2005-12-09 23:58 58328 —-a-w- c:\documents and settings\Scott Mills\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-06-19 11:23 . 2010-06-19 11:23 ——– d—–w- c:\program files\MSECache
2010-06-14 14:31 . 2004-08-04 08:00 744448 —-a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-06-05 10:42 . 2009-04-01 14:56 ——– d—–w- c:\program files\Microsoft Silverlight
2010-05-27 07:46 . 2010-05-27 07:46 503808 —-a-w- c:\documents and settings\Scott Mills\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-6252978f-n\msvcp71.dll
2010-05-27 07:46 . 2010-05-27 07:46 61440 —-a-w- c:\documents and settings\Scott Mills\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-48e27ef7-n\decora-sse.dll
2010-05-27 07:46 . 2010-05-27 07:46 499712 —-a-w- c:\documents and settings\Scott Mills\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-6252978f-n\jmc.dll
2010-05-27 07:46 . 2010-05-27 07:46 348160 —-a-w- c:\documents and settings\Scott Mills\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-6252978f-n\msvcr71.dll
2010-05-27 07:46 . 2010-05-27 07:46 12800 —-a-w- c:\documents and settings\Scott Mills\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-48e27ef7-n\decora-d3d.dll
2010-05-18 15:35 . 2010-05-18 15:35 91424 —-a-w- c:\windows\system32\dnssd.dll
2010-05-18 15:35 . 2010-05-18 15:35 107808 —-a-w- c:\windows\system32\dns-sd.exe
2010-05-06 10:41 . 2004-08-04 08:00 916480 —-a-w- c:\windows\system32\wininet.dll
2010-05-02 05:22 . 2004-08-04 08:00 1851264 —-a-w- c:\windows\system32\win32k.sys
2010-04-29 14:39 . 2010-01-04 12:26 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-29 14:39 . 2010-01-04 12:26 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2008-06-30 12:44 . 2008-09-30 11:15 324976 -c–a-w- c:\program files\mozilla firefox\components\coFFPlgn.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2009-07-26 3883856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-12-13 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-12-13 126976]
"SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 1388544]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2005-02-08 159744]
"hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2005-04-11 794624]
"LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2004-10-14 253952]
"eabconfg.cpl"="c:\program files\HPQ\Quick Launch Buttons\EabServr.exe" [2004-12-03 290816]
"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2004-09-07 213054]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-06-28 32768]
"AGRSMMSG"="AGRSMMSG.exe" [2005-11-16 88209]
"LXSUPMON"="c:\windows\system32\LXSUPMON.EXE" [2002-07-08 886272]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2010-03-12 49208]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-17 421888]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-06-15 141624]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Device Detector 3.lnk - c:\program files\Olympus\DeviceDetector\DevDtct2.exe [2009-3-6 118784]
HP Digital Imaging Monitor.lnk - c:\program files\Hp\Digital Imaging\bin\hpqtra08.exe [2009-5-21 275768]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]
@="FSFilter Activity Monitor"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\Common Files\\HP\\Digital Imaging\\Bin\\hpqPhotoCrm.exe"=
"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqgplgtupl.exe"=
"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqgpc01.exe"=
"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqusgm.exe"=
"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqusgh.exe"=
"c:\\Program Files\\Hp\\HP Software Update\\hpwucli.exe"=
"c:\\Program Files\\Hp\\Digital Imaging\\smart web printing\\SmartWebPrintExe.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360\0308000.029\SymEFA.sys [03/02/2010 19:56 310320]
R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\N360\0308000.029\BHDrvx86.sys [03/02/2010 19:56 259632]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\N360\0308000.029\cchpx86.sys [03/02/2010 19:56 482432]
R1 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100720.001\IDSXpx86.sys [21/07/2010 12:22 331640]
R2 N360;Norton 360;c:\program files\Norton 360\Engine\3.8.0.41\ccSvcHst.exe [03/02/2010 19:55 117640]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [27/05/2010 22:27 102448]

— Other Services/Drivers In Memory —

*NewlyCreated* - FXTDYPOW
*Deregistered* - fxtdypow

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
2009-03-08 04:32 128512 —-a-w- c:\windows\system32\advpack.dll
.
Contents of the 'Scheduled Tasks' folder

2010-07-17 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2010-07-21 c:\windows\Tasks\System Restore.job
- c:\windows\system32\Restore\rstrui.exe [2004-08-04 00:12]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.tiscali.co.uk/
uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_GB&c=Q305&bd=presario&pf=laptop
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Scott Mills\Application Data\Mozilla\Firefox\Profiles\emgdb7zc.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.tiscali.co.uk/index_first.html
FF - prefs.js: network.proxy.type - 4
FF - component: c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\components\coFFPlgn.dll
FF - component: c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\IPSFFPlgn\components\IPSFFPl.dll
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{E52BE12D-A44A-4F51-9DC1-34F37A488CC7} - (no file)
HKCU-Run-AdobeBridge - (no file)



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-23 14:07
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe????????5?7?9?9??@???? ???B???????????????B? ??????

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\N360]
"ImagePath"="\"c:\program files\Norton 360\Engine\3.8.0.41\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files\Norton 360\Engine\3.8.0.41\diMaster.dll\" /prefetch:1"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(1056)
c:\windows\system32\igfxsrvc.dll
c:\windows\system32\hccutils.DLL
.
Completion time: 2010-07-23 14:11:29
ComboFix-quarantined-files.txt 2010-07-23 13:11

Pre-Run: 6,338,732,032 bytes free
Post-Run: 6,720,434,176 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

- - End Of File - - C1F1DAD533BC2DB223B0877F00AB0AA8
Post #8
Hi, I just needed to see the deletions from the first run, did you have trouble running it and you needed to run it again? That's fine, if you could run MBAM and the Kaspersky scan now, thanks.
Post #9
Hi, The first run of ComboFix was from the previous thread I had on here. Here are my MBAM and Kerpersky reports: Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Database version: 4410 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 09/08/2010 16:40:21 mbam-log-2010-08-09 (16-40-21).txt Scan type: Quick scan Objects scanned: 146481 Time elapsed: 20 minute(s), 36 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) ——————————————————————————– KASPERSKY ONLINE SCANNER 7.0: scan report Tuesday, August 10, 2010 Operating system: Microsoft Windows XP Home Edition Service Pack 3 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Last database update: Monday, August 09, 2010 02:35:13 Records in database: 4131622 ——————————————————————————– Scan settings: scan using the following database: extended Scan archives: yes Scan e-mail databases: yes Scan area - My Computer: C:\ D:\ Scan statistics: Objects scanned: 79488 Threats found: 1 Infected objects found: 1 Suspicious objects found: 0 Scan duration: 05:22:17 File name / Threat / Threats count C:\Program Files\Online Services\BTYahoo\HPPre05.msi Infected: not-a-virus:Dialer.Win32.BT.g 1 Selected area has been scanned.
Post #10
Hi

Please do the following:


Clear Sun Jave cache

Go into the Control Panel and double-click the Java Icon. (looks like a coffee cup) If you do not see the icon, look to your left and click 'Switch to Classic View'.
  • On the General tab, under Temporary Internet Files, click the Settings button.
  • Next, click on the Delete Files button
  • There are two options in the window to clear the cache - Leave BOTH Checked
    • Applications and Applets
      Trace and Log Files
  • Click OK on Delete Temporary Files Window
    Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
  • Click OK to leave the Temporary Files Window
  • Click OK to leave the Java Control Panel.


NEXT

Download TFC to your desktop
Mirror
  • Close any open windows.
  • Double click the TFC icon to run the program
  • TFC will close all open programs itself in order to run,
  • Click the Start button to begin the process.
  • Allow TFC to run uninterrupted.
  • The program should not take long to finish it's job
  • Once its finished it should automatically reboot your machine,
  • if it doesn't, manually reboot to ensure a complete clean
It's normal after running TFC cleaner that the PC will be slower to boot the first time.


NEXT

Download and run Auslogics Disc Defragmenter

Make sure when installing that you say NO to the Ask toolbar.


NEXT

Please advise how your computer is running and if there are any outstanding issues.
Post #11
Hi Catbyte, I have cleared my cache, ran TFC and the Defrag. Its still slow on start up, but as long as there are no viruses then I'm not particularly bothered about that. It was the fact that Norton alerted me to any intrusion to my hard disk volume that worried me. I've had this laptop for 5 years and the hinge and mousepad have just about given up anyway. I was hoping to get another couple of years out of it, but if I buy a new PC, or Mac, could any viruses be transferred to the new one by a USB drive, Ipod etc. that I've used with this computer? Furthermore could viruses hide in my router to transfer to a new laptop that way? I'm sorry if these questions seem silly but I'm purely a consumer level user of computers with little technical knowledge. Thanks.
Post #12 last edited
run this program on all your usb drives etc. It will clean them

Download Flash_Disinfector.exe from HERE and save it to your desktop.

  • Double-click Flash_Disinfector.exe to run it and follow any prompts that may appear.
  • The utility may ask you to insert your flash drive and/or other removable drives including your mobile phone. Please do so and allow the utility to clean up those drives as well.
  • Wait until it has finished scanning and then exit the program.
  • Reboot your computer when done.


You can reset your router and set a strong password:
  • Consult this link to find out what is the default username and password of your router and note down them: Route Passwords

  • Then rest your router to it's factory default settings:

    Reset your router to its default configuration. Usually, this can be done by inserting something tiny like a paper clip end or pencil tip into a small hole labeled "reset" located on the back of the router. Press and hold down the small button inside until the lights on the front of the router blink off and then on again (usually about 10 seconds)"


  • This is the difficult part.
    First get to the routers server. To do that type http:\\192.168.1.1 in the address bar and click Enter. You get the log in window.
    Fill in the password you have already found and you will get the configuration page.
    Configure the router to allow you to connect to your ISP server. In some routers it is done by a setup wizard. But you have to fill in the log in password your ISP has initially given to you.
    You can also call your ISP if you don't have your initial password.
    Don't forget to change the routers default password and set a strong password. Note down the password and keep it somewhere for future reference.

  • Please make sure of the following settings:
    • Go to start => Control panel => Double-click Network and Sharing Center.
    • In the left window select Manage network Connection.
    • In the right window right-click Local Area connection and select Properties .
    • Internet Protocol Version 6 (IP6v) should be checked. Double-click on it: Make sure of the following settings:
    • The option Obtain an IP address automatically should be checked.
    • The option Obtain DNS server address automatically should be checked.
    • Click OK.
    • Internet Protocol Version 4 (IP4v) should be checked. Double-click on it.
    • The option Obtain an IP address automatically should be checked.
    • The option Obtain DNS server address automatically should be checked.
  • Click OK twice.
  • If you should change any setting reboot the computer.
Post #13
OK thanks for that Catbyte. My router has always had a strong password on it so I think we're good on that front. I see the Kerpersky scan foud something labeled "not-a-virus:dialer…". Is this anything to worry about?
Post #14 last edited
that's an installation file for your BT yahoo, did you install that program yourself it is not malicious. Please post a fresh DDS log and advise how the computer is running now and if there are any outstanding issues.
Post #15 last edited
I've never used BT to supply my internet, so I'm not sure how the "not-a-virus:dialer…" threat got there. Could this be something that came with my PC when I bought it? I remember there being shortcuts for certain internet providers on the desktop when it was new. I had to run the DDS twice as the first time I forgot to shut off my antivirus. My computer seems to be running fine - there are no obvious symtpoms. DDS (Ver_10-03-17.01) - NTFSx86 Run by [removed] at 21:23:36.59 on 17/08/2010 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_21 Microsoft Windows XP Home Edition 5.1.2600.3.1252.44.1033.18.1270.646 [GMT 1:00] AV: Norton 360 *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8} FW: Norton 360 *disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220} ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE svchost.exe C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe C:\Program Files\Flip Video\FlipShare\FlipShareService.exe C:\WINDOWS\system32\svchost.exe -k hpdevmgmt C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Norton 360\Engine\3.8.0.41\ccSvcHst.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\Program Files\Canon\CAL\CALMAIN.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\igfxtray.exe C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe C:\Program Files\Apoint2K\Apoint.exe C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Apoint2K\Apntex.exe C:\WINDOWS\AGRSMMSG.exe C:\WINDOWS\system32\LXSUPMON.EXE C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe C:\Program Files\HPQ\SHARED\HPQWMI.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\System32\svchost.exe -k HTTPFilter C:\Program Files\Norton 360\Engine\3.8.0.41\ccSvcHst.exe C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\wscntfy.exe C:\Documents and Settings\Scott Mills\Desktop\dds.com ============== Pseudo HJT Report =============== uStart Page = hxxp://www.tiscali.co.uk/ uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_GB&c=Q305&bd=presario&pf=laptop uInternet Settings,ProxyOverride = *.local BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File BHO: Symantec NCO BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - c:\program files\norton 360\engine\3.8.0.41\coIEPlg.dll BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\program files\norton 360\engine\3.8.0.41\IPSBHO.DLL BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - c:\program files\norton 360\engine\3.8.0.41\coIEPlg.dll EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - c:\program files\hp\digital imaging\smart web printing\hpswp_bho.dll uRun: [MsnMsgr] "c:\program files\windows live\messenger\MsnMsgr.Exe" /background uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe mRun: [IgfxTray] c:\windows\system32\igfxtray.exe mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe mRun: [SoundMAXPnP] c:\program files\analog devices\soundmax\SMax4PNP.exe mRun: [Apoint] c:\program files\apoint2k\Apoint.exe mRun: [hpWirelessAssistant] c:\program files\hpq\hp wireless assistant\HP Wireless Assistant.exe mRun: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe mRun: [eabconfg.cpl] c:\program files\hpq\quick launch buttons\EabServr.exe /Start mRun: [Cpqset] c:\program files\hpq\default settings\cpqset.exe mRun: [RemoteControl] "c:\program files\cyberlink\powerdvd\PDVDServ.exe" mRun: [AGRSMMSG] AGRSMMSG.exe mRun: [LXSUPMON] c:\windows\system32\LXSUPMON.EXE RUN mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\device~1.lnk - c:\program files\olympus\devicedetector\DevDtct2.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office11\EXCEL.EXE/3000 IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office11\REFIEBAR.DLL IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://a1540.g.akamai.net/7/1540/52/20061205/qtinstall.info.apple.com/qtactivex/qtplugin.cab DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/5/b/0/5b0d4654-aa20-495c-b89f-c1c34c691085/LegitCheckControl.cab DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} - hxxps://webdl.symantec.com/activex/symdlmgr.cab DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} - hxxps://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} - hxxp://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} - hxxp://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab Handler: symres - {AA1061FE-6C41-421f-9344-69640C9732AB} - c:\program files\norton 360\engine\3.8.0.41\CoIEPlg.dll Notify: igfxcui - igfxsrvc.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll mASetup: {A509B1FF-37FF-4bFF-8CFF-4F3A747040FF} - c:\windows\system32\rundll32.exe c:\windows\system32\advpack.dll,launchinfsectionex c:\program files\internet explorer\clrtour.inf,DefaultInstall.ResetTour,,12 ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\scottm~1\applic~1\mozilla\firefox\profiles\emgdb7zc.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.tiscali.co.uk/index_first.html FF - prefs.js: network.proxy.type - 4 FF - component: c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\coffplgn\components\coFFPlgn.dll FF - component: c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\ipsffplgn\components\IPSFFPl.dll FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: c:\program files\microsoft\office live\npOLW.dll FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\ FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} ============= SERVICES / DRIVERS =============== R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\n360\0308000.029\SymEFA.sys [2010-2-3 310320] R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\n360\0308000.029\BHDrvx86.sys [2010-2-3 259632] R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\n360\0308000.029\cchpx86.sys [2010-2-3 482432] R1 IDSxpx86;IDSxpx86;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\ipsdefs\20100813.004\IDSXpx86.sys [2010-8-14 331640] R2 N360;Norton 360;c:\program files\norton 360\engine\3.8.0.41\ccSvcHst.exe [2010-2-3 117640] R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2010-5-27 102448] R3 NAVENG;NAVENG;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\virusdefs\20100816.016\NAVENG.SYS [2010-8-16 85424] R3 NAVEX15;NAVEX15;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\virusdefs\20100816.016\NAVEX15.SYS [2010-8-16 1362608] =============== Created Last 30 ================ 2010-08-10 13:42:20 0 d—–w- c:\docume~1\scottm~1\applic~1\Auslogics 2010-08-10 13:42:04 0 d—–w- c:\program files\Auslogics 2010-08-07 14:22:39 98816 —-a-w- c:\windows\sed.exe 2010-08-07 14:22:39 77312 —-a-w- c:\windows\MBR.exe 2010-08-07 14:22:39 256512 —-a-w- c:\windows\PEV.exe 2010-08-07 14:22:39 161792 —-a-w- c:\windows\SWREG.exe 2010-07-31 17:47:39 0 d—–w- c:\program files\iPod 2010-07-31 17:47:19 0 d—–w- c:\program files\iTunes 2010-07-26 13:14:44 0 d—–w- c:\program files\Flip Video 2010-07-26 13:14:43 0 d—–w- c:\docume~1\alluse~1\applic~1\Flip Video 2010-07-24 12:40:20 73728 —-a-w- c:\windows\system32\javacpl.cpl 2010-07-23 12:58:10 0 d-sha-r- C:\cmdcons ==================== Find3M ==================== 2010-07-27 06:30:35 8462336 ——w- c:\windows\system32\dllcache\shell32.dll 2010-07-24 12:39:40 423656 —-a-w- c:\windows\system32\deployJava1.dll 2010-06-30 12:31:35 149504 —-a-w- c:\windows\system32\schannel.dll 2010-06-30 12:31:35 149504 ——w- c:\windows\system32\dllcache\schannel.dll 2010-06-24 16:51:58 11077120 —-a-w- c:\windows\system32\dllcache\ieframe.dll 2010-06-24 12:22:03 916480 —-a-w- c:\windows\system32\wininet.dll 2010-06-24 12:22:03 916480 —-a-w- c:\windows\system32\dllcache\wininet.dll 2010-06-24 12:22:03 12800 ——w- c:\windows\system32\dllcache\xpshims.dll 2010-06-24 12:22:02 1210368 —-a-w- c:\windows\system32\dllcache\urlmon.dll 2010-06-24 12:22:01 611840 —-a-w- c:\windows\system32\dllcache\mstime.dll 2010-06-24 12:22:01 5951488 —-a-w- c:\windows\system32\dllcache\mshtml.dll 2010-06-24 12:22:01 206848 —-a-w- c:\windows\system32\dllcache\occache.dll 2010-06-24 12:21:59 599040 —-a-w- c:\windows\system32\dllcache\msfeeds.dll 2010-06-24 12:21:59 55296 —-a-w- c:\windows\system32\dllcache\msfeedsbs.dll 2010-06-24 12:21:59 25600 —-a-w- c:\windows\system32\dllcache\jsproxy.dll 2010-06-24 12:21:58 247808 ——w- c:\windows\system32\dllcache\ieproxy.dll 2010-06-24 12:21:58 1986560 —-a-w- c:\windows\system32\dllcache\iertutil.dll 2010-06-24 12:21:58 184320 —-a-w- c:\windows\system32\dllcache\iepeers.dll 2010-06-24 12:21:56 743424 ——w- c:\windows\system32\dllcache\iedvtool.dll 2010-06-24 12:21:55 387584 —-a-w- c:\windows\system32\dllcache\iedkcs32.dll 2010-06-23 13:44:04 1851904 —-a-w- c:\windows\system32\win32k.sys 2010-06-23 13:44:04 1851904 ——w- c:\windows\system32\dllcache\win32k.sys 2010-06-23 12:08:09 173056 —-a-w- c:\windows\system32\dllcache\ie4uinit.exe 2010-06-21 15:27:11 354304 —-a-w- c:\windows\system32\drivers\srv.sys 2010-06-21 15:27:11 354304 ——w- c:\windows\system32\dllcache\srv.sys 2010-06-18 13:36:12 3558912 ——w- c:\windows\system32\dllcache\moviemk.exe 2010-06-17 14:03:00 80384 —-a-w- c:\windows\system32\iccvid.dll 2010-06-14 14:31:20 744448 ——w- c:\windows\system32\dllcache\helpsvc.exe 2010-06-14 07:41:45 1172480 —-a-w- c:\windows\system32\msxml3.dll 2010-06-14 07:41:45 1172480 ——w- c:\windows\system32\dllcache\msxml3.dll 2008-09-05 13:36:17 32768 -csha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008090520080906\index.dat ============= FINISH: 21:23:50.09 ===============

Attachments:

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI