trojan.bamital!inf and remote intrusion attempts

Hello,

I have a PC that norton has identified the trojan.bamital!inf in explorer.exe and winlogon.exe. I've replaced the two files with clean files from the orginal windows CD. Norton is also reporting Network traffic from n16fa53.com matches a signature of a known attack. The attack was resulted from \DEVICE\HARDDISKVOLUME1\
WINDOWS\SYSTEM32\SVCHOST.EXE. IP address of the attemp is 91.212.226.5:443 to destination address of 192.168.1.1:4945

Scans by Malwarebaytes and SuperAntiSpyware are clean.

PC Running Windows XP SP3

Below is the requested scan from OTL. OTL.txt and Extras.txt

OTL.TXT
OTL logfile created on: 12/7/2010 12:42:32 PM - Run 1
OTL by OldTimer - Version 3.2.17.3 Folder = C:\Anti Virus Cleanup tools
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 51.00% Memory free
2.00 Gb Paging File | 1.00 Gb Available in Paging File | 64.00% Paging File free
Paging file location(s): C:\pagefile.sys 576 1152 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 145.97 Gb Total Space | 112.51 Gb Free Space | 77.08% Space Free | Partition Type: NTFS
Drive D: | 3.07 Gb Total Space | 0.85 Gb Free Space | 27.59% Space Free | Partition Type: FAT32

Computer Name: E-MACHINE | User Name: Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Anti Virus Cleanup tools\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
PRC - C:\Program Files\Carbonite\CarbonitePreinstaller.exe (Carbonite, Inc.)
PRC - C:\Program Files\Citrix\GoToAssist Express Customer\258\g2ax_user_medium_customer.exe (Citrix Online, a division of Citrix Systems, Inc.)
PRC - C:\Program Files\Citrix\GoToAssist Express Customer\258\g2ax_user_customer.exe (Citrix Online, a division of Citrix Systems, Inc.)
PRC - C:\Program Files\Citrix\GoToAssist Express Customer\258\g2ax_system_customer.exe (Citrix Online, a division of Citrix Systems, Inc.)
PRC - C:\Program Files\Citrix\GoToAssist Express Customer\258\g2ax_service.exe (Citrix Online, a division of Citrix Systems, Inc.)
PRC - C:\Program Files\Citrix\GoToAssist Express Customer\258\g2ax_host.exe (Citrix Online, a division of Citrix Systems, Inc.)
PRC - C:\Program Files\Citrix\GoToAssist Express Customer\258\g2ax_comm_customer.exe (Citrix Online, a division of Citrix Systems, Inc.)
PRC - C:\Program Files\Norton AntiVirus\Engine\18.1.0.37\ccSvcHst.exe (Symantec Corporation)
PRC - C:\Program Files\FaxTalk\FTmsgsvc.exe (Thought Communications, Inc.)
PRC - C:\Program Files\FaxTalk\FTclctrl.exe (Thought Communications, Inc.)
PRC - C:\Program Files\FaxTalk\Fapiexe.exe (Thought Communications, Inc.)
PRC - C:\Program Files\AWS\WeatherBug\Weather.exe (AWS Convergence Technologies, Inc.)
PRC - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS (New Boundary Technologies, Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\cmd.exe (Microsoft Corporation)
PRC - C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
PRC - C:\Program Files\Digital Media Reader\shwiconEM.exe (Alcor Micro, Corp.)


========== Modules (SafeList) ==========

MOD - C:\Anti Virus Cleanup tools\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (AppMgmt) – C:\WINDOWS\System32\appmgmts.dll File not found
SRV - (GoToAssist Express Customer) – C:\Program Files\Citrix\GoToAssist Express Customer\258\g2ax_service.exe (Citrix Online, a division of Citrix Systems, Inc.)
SRV - (NAV) – C:\Program Files\Norton AntiVirus\Engine\18.1.0.37\ccSvcHst.exe (Symantec Corporation)
SRV - (FaxTalk Messenger Pro 8) – C:\Program Files\FaxTalk\FTmsgsvc.exe (Thought Communications, Inc.)
SRV - (PrismXL) – C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS (New Boundary Technologies, Inc.)
SRV - (YahooAUService) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)


========== Driver Services (SafeList) ==========

DRV - (winachsf) – C:\WINDOWS\System32\DRIVERS\HSF_CNXT.sys File not found
DRV - (wanatw) WAN Miniport (ATW) – C:\WINDOWS\System32\DRIVERS\wanatw4.sys File not found
DRV - (RPSKT) Security Services Driver (x86) – C:\WINDOWS\System32\DRIVERS\rp_skt32.sys File not found
DRV - (mdmxsdk) – C:\WINDOWS\System32\DRIVERS\mdmxsdk.sys File not found
DRV - (HSFHWBS2) – C:\WINDOWS\System32\DRIVERS\HSFHWBS2.sys File not found
DRV - (HSF_DPV) – C:\WINDOWS\System32\DRIVERS\HSF_DPV.sys File not found
DRV - (NAVEX15) – C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\VirusDefs\20101206.049\NAVEX15.SYS (Symantec Corporation)
DRV - (eeCtrl) – C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys (Symantec Corporation)
DRV - (EraserUtilRebootDrv) – C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (NAVENG) – C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\VirusDefs\20101206.049\NAVENG.SYS (Symantec Corporation)
DRV - (SymEvent) – C:\WINDOWS\system32\drivers\SYMEVENT.SYS (Symantec Corporation)
DRV - (BHDrvx86) – C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\BASHDefs\20101123.003\BHDrvx86.sys (Symantec Corporation)
DRV - (IDSxpx86) – C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\IPSDefs\20101201.001\IDSXpx86.sys (Symantec Corporation)
DRV - (SymEFA) – C:\WINDOWS\system32\drivers\NAV\1201000.025\SYMEFA.SYS (Symantec Corporation)
DRV - (SRTSP) – C:\WINDOWS\system32\drivers\NAV\1201000.025\SRTSP.SYS (Symantec Corporation)
DRV - (SRTSPX) Symantec Real Time Storage Protection (PEL) – C:\WINDOWS\system32\drivers\NAV\1201000.025\SRTSPX.SYS (Symantec Corporation)
DRV - (SYMTDI) – C:\WINDOWS\system32\drivers\NAV\1201000.025\SYMTDI.SYS (Symantec Corporation)
DRV - (SymIRON) – C:\WINDOWS\system32\drivers\NAV\1201000.025\Ironx86.SYS (Symantec Corporation)
DRV - (SymDS) – C:\WINDOWS\system32\drivers\NAV\1201000.025\SYMDS.SYS (Symantec Corporation)
DRV - (SASKUTIL) – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (RTL8023xp) – C:\WINDOWS\system32\drivers\Rtnicxp.sys (Realtek Semiconductor Corporation )
DRV - (amdagp) – C:\WINDOWS\system32\DRIVERS\amdagp.sys (Advanced Micro Devices, Inc.)
DRV - (sisagp) – C:\WINDOWS\system32\DRIVERS\sisagp.sys (Silicon Integrated Systems Corporation)
DRV - (AmdPPM) – C:\WINDOWS\system32\drivers\AmdPPM.sys (Advanced Micro Devices)
DRV - (AgereSoftModem) – C:\WINDOWS\system32\drivers\AGRSM.sys (Agere Systems)
DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) – C:\WINDOWS\system32\drivers\ALCXWDM.SYS (Realtek Semiconductor Corp.)
DRV - (SunkFilt) – C:\WINDOWS\system32\drivers\Sunkfilt.sys (Alcor Micro Corp.)
DRV - (AFS2K) – C:\WINDOWS\System32\drivers\AFS2K.SYS (Oak Technology Inc.)
DRV - (nv) – C:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation)
DRV - (HSF_DP) – C:\WINDOWS\system32\drivers\HSF_DP.sys (Conexant Systems, Inc.)
DRV - (Sparrow) – C:\WINDOWS\system32\DRIVERS\sparrow.sys (Adaptec, Inc.)
DRV - (sym_u3) – C:\WINDOWS\system32\DRIVERS\sym_u3.sys (LSI Logic)
DRV - (sym_hi) – C:\WINDOWS\system32\DRIVERS\sym_hi.sys (LSI Logic)
DRV - (symc8xx) – C:\WINDOWS\system32\DRIVERS\symc8xx.sys (LSI Logic)
DRV - (symc810) – C:\WINDOWS\system32\DRIVERS\symc810.sys (Symbios Logic Inc.)
DRV - (ultra) – C:\WINDOWS\system32\DRIVERS\ultra.sys (Promise Technology, Inc.)
DRV - (ql12160) – C:\WINDOWS\system32\DRIVERS\ql12160.sys (QLogic Corporation)
DRV - (ql1080) – C:\WINDOWS\system32\DRIVERS\ql1080.sys (QLogic Corporation)
DRV - (ql1280) – C:\WINDOWS\system32\DRIVERS\ql1280.sys (QLogic Corporation)
DRV - (dac2w2k) – C:\WINDOWS\system32\DRIVERS\dac2w2k.sys (Mylex Corporation)
DRV - (mraid35x) – C:\WINDOWS\system32\DRIVERS\mraid35x.sys (American Megatrends Inc.)
DRV - (asc) – C:\WINDOWS\system32\DRIVERS\asc.sys (Advanced System Products, Inc.)
DRV - (asc3550) – C:\WINDOWS\system32\DRIVERS\asc3550.sys (Advanced System Products, Inc.)
DRV - (AliIde) – C:\WINDOWS\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)
DRV - (CmdIde) – C:\WINDOWS\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.)
DRV - (mxnic) – C:\WINDOWS\system32\drivers\mxnic.sys (Macronix International Co., Ltd. )


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.usatoday.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\software\mozilla\Firefox\extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\IPSFFPlgn\ [2010/12/06 17:43:33 | 000,000,000 | —D | M]


O1 HOSTS File: ([2004/08/04 14:00:00 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton AntiVirus\Engine\18.1.0.37\IPSBHO.dll (Symantec Corporation)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [CarboniteSetupLite] C:\Program Files\Carbonite\CarbonitePreinstaller.exe (Carbonite, Inc.)
O4 - HKLM..\Run: [FaxTalk Messenger Pro 8] C:\Program Files\FaxTalk\FTClCtrl.exe (Thought Communications, Inc.)
O4 - HKLM..\Run: [Recguard] C:\WINDOWS\SMINST\Recguard.exe ()
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconEM.exe (Alcor Micro, Corp.)
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
O4 - HKCU..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe (AWS Convergence Technologies, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microsoftu…b?1254790005968 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\GoToAssist Express Customer: DllName - C:\Program Files\Citrix\GoToAssist Express Customer\258\g2ax_winlogon.dll - C:\Program Files\Citrix\GoToAssist Express Customer\258\g2ax_winlogon.dll (Citrix Online, a division of Citrix Systems, Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O28 - HKLM ShellExecuteHooks: {EDB0E980-90BD-11D4-8599-0008C7D3B6F8} - C:\Program Files\Qualcomm\Eudora\EuShlExt.dll (Qualcomm Inc.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/03/23 13:13:17 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2004/09/13 12:15:24 | 000,000,053 | -HS- | M] () - D:\Autorun.inf – [ FAT32 ]
O32 - AutoRun File - [2003/08/08 17:24:26 | 000,000,045 | -HS- | M] () - D:\autorun.inf.aug.8 – [ FAT32 ]
O33 - MountPoints2\{cd831d81-b20b-11de-bb75-806d6172696f}\Shell - "" = AutoRun
O33 - MountPoints2\{cd831d81-b20b-11de-bb75-806d6172696f}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\D\Shell - "" = AutoRun
O33 - MountPoints2\D\Shell\AutoRun - "" = Auto&Play
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Unable to start service SrService!

========== Files/Folders - Created Within 30 Days ==========

[2010/12/07 10:13:17 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\Adobe
[2010/12/07 09:27:43 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Sun
[2010/12/07 09:23:34 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2010/12/06 18:15:49 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Local Settings\Application Data\Broderbund Software
[2010/12/06 18:15:49 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Broderbund Software
[2010/12/06 18:11:03 | 000,035,840 | —- | C] (Oak Technology Inc.) – C:\WINDOWS\System32\drivers\AFS2K.SYS
[2010/12/06 18:10:55 | 000,000,000 | —D | C] – C:\Program Files\Web Publish
[2010/12/06 18:10:50 | 000,970,752 | —- | C] (Amyuni Technologies
http://www.amyuni.com) – C:\WINDOWS\System32\cdintf210.dll
[2010/12/06 18:04:15 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\My Documents\The Print Shop Small Business Center Forms
[2010/12/06 18:01:52 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Broderbund
[2010/12/06 18:01:47 | 000,000,000 | —D | C] – C:\Program Files\The Print Shop 22
[2010/12/06 17:42:57 | 000,126,512 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\SYMEVENT.SYS
[2010/12/06 17:42:57 | 000,060,808 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\S32EVNT1.DLL
[2010/12/06 17:42:57 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Symantec Shared
[2010/12/06 17:42:57 | 000,000,000 | —D | C] – C:\Program Files\Symantec
[2010/12/06 17:42:47 | 000,666,672 | R— | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\NAV\1201000.025\SymEFA.sys
[2010/12/06 17:42:47 | 000,489,008 | R— | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\NAV\1201000.025\srtsp.sys
[2010/12/06 17:42:47 | 000,369,072 | R— | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\NAV\1201000.025\symtdi.sys
[2010/12/06 17:42:47 | 000,339,504 | R— | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\NAV\1201000.025\SymDS.sys
[2010/12/06 17:42:47 | 000,331,312 | R— | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\NAV\1201000.025\symtdiv.sys
[2010/12/06 17:42:47 | 000,294,448 | R— | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\NAV\1201000.025\symnets.sys
[2010/12/06 17:42:47 | 000,134,704 | R— | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\NAV\1201000.025\Ironx86.sys
[2010/12/06 17:42:47 | 000,050,096 | R— | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\NAV\1201000.025\srtspx.sys
[2010/12/06 17:42:28 | 000,000,000 | —D | C] – C:\WINDOWS\System32\drivers\NAV
[2010/12/06 17:42:28 | 000,000,000 | —D | C] – C:\WINDOWS\System32\drivers\NAV\1201000.025
[2010/12/06 17:42:25 | 000,000,000 | —D | C] – C:\Program Files\Norton AntiVirus
[2010/12/06 17:41:47 | 000,000,000 | —D | C] – C:\Program Files\NortonInstaller
[2010/12/06 16:58:21 | 000,000,000 | —D | C] – C:\NBRT
[2010/12/06 16:27:11 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Application Data\SUPERAntiSpyware.com
[2010/12/06 16:27:11 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
[2010/12/06 16:26:57 | 000,000,000 | —D | C] – C:\Program Files\SUPERAntiSpyware
[2010/12/06 16:04:15 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2010/12/06 15:45:07 | 001,033,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\explorer.exe.new
[2010/12/06 15:40:56 | 000,015,872 | —- | C] (Microsoft Corporation) – C:\WINDOWS\EXPAND.EXE
[2010/12/06 15:35:43 | 001,033,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\explorer.exe
[2010/12/06 14:33:22 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Application Data\Tific
[2010/12/06 14:33:20 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Local Settings\Application Data\Symantec
[2010/12/06 11:38:22 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Java
[2010/12/06 11:37:55 | 000,000,000 | —D | C] – C:\Program Files\Carbonite
[2010/12/06 11:37:11 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\My Documents\Symantec
[2010/12/06 11:37:02 | 000,153,376 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaws.exe
[2010/12/06 11:37:02 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaw.exe
[2010/12/06 11:37:02 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\java.exe
[2010/12/06 11:31:40 | 000,000,000 | —D | C] – C:\Program Files\Windows Sidebar
[2010/12/06 11:31:39 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Norton
[2010/12/06 11:29:27 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\NortonInstaller
[2010/12/05 17:29:51 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Application Data\Malwarebytes
[2010/12/05 17:29:00 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/12/05 17:28:59 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/12/05 17:28:56 | 000,020,952 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2010/12/05 17:28:56 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/12/05 17:13:10 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Adobe
[2010/12/05 17:07:52 | 000,000,000 | —D | C] – C:\Anti Virus Cleanup tools
[2010/11/30 16:47:08 | 000,000,000 | -H-D | C] – C:\Documents and Settings\All Users\Documents\Server
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/12/07 12:31:03 | 000,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/12/07 12:13:03 | 000,014,739 | —- | M] () – C:\WINDOWS\System32\12543.js
[2010/12/07 12:13:03 | 000,000,432 | —- | M] () – C:\WINDOWS\tasks\At13.job
[2010/12/07 11:13:15 | 000,000,432 | —- | M] () – C:\WINDOWS\tasks\At12.job
[2010/12/07 10:56:57 | 000,000,364 | —- | M] () – C:\Documents and Settings\Owner\Desktop\IE.reg
[2010/12/07 10:50:49 | 000,000,449 | —- | M] () – C:\Shortcut to Anti Virus Cleanup tools.lnk
[2010/12/07 10:50:49 | 000,000,449 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Shortcut to Anti Virus Cleanup tools.lnk
[2010/12/07 10:50:31 | 000,001,475 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Windows Explorer.lnk
[2010/12/07 10:26:28 | 000,000,432 | —- | M] () – C:\WINDOWS\tasks\At11.job
[2010/12/07 10:26:21 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/12/07 10:26:17 | 001,156,936 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/12/07 09:54:11 | 000,000,432 | —- | M] () – C:\WINDOWS\tasks\At9.job
[2010/12/07 09:54:11 | 000,000,432 | —- | M] () – C:\WINDOWS\tasks\At8.job
[2010/12/07 09:54:11 | 000,000,432 | —- | M] () – C:\WINDOWS\tasks\At7.job
[2010/12/07 09:54:11 | 000,000,432 | —- | M] () – C:\WINDOWS\tasks\At6.job
[2010/12/07 09:54:11 | 000,000,432 | —- | M] () – C:\WINDOWS\tasks\At5.job
[2010/12/07 09:54:11 | 000,000,432 | —- | M] () – C:\WINDOWS\tasks\At4.job
[2010/12/07 09:54:11 | 000,000,432 | —- | M] () – C:\WINDOWS\tasks\At3.job
[2010/12/07 09:54:11 | 000,000,432 | —- | M] () – C:\WINDOWS\tasks\At24.job
[2010/12/07 09:54:11 | 000,000,432 | —- | M] () – C:\WINDOWS\tasks\At23.job
[2010/12/07 09:54:11 | 000,000,432 | —- | M] () – C:\WINDOWS\tasks\At22.job
[2010/12/07 09:54:11 | 000,000,432 | —- | M] () – C:\WINDOWS\tasks\At21.job
[2010/12/07 09:54:11 | 000,000,432 | —- | M] () – C:\WINDOWS\tasks\At20.job
[2010/12/07 09:54:11 | 000,000,432 | —- | M] () – C:\WINDOWS\tasks\At2.job
[2010/12/07 09:54:11 | 000,000,432 | —- | M] () – C:\WINDOWS\tasks\At19.job
[2010/12/07 09:54:11 | 000,000,432 | —- | M] () – C:\WINDOWS\tasks\At1.job
[2010/12/07 09:13:01 | 000,000,432 | —- | M] () – C:\WINDOWS\tasks\At10.job
[2010/12/07 03:00:13 | 000,650,860 | —- | M] () – C:\WINDOWS\System32\drivers\NAV\1201000.025\Cat.DB
[2010/12/06 18:15:45 | 000,002,239 | —- | M] () – C:\Documents and Settings\All Users\Desktop\The Print Shop 22.lnk
[2010/12/06 17:42:57 | 000,126,512 | —- | M] (Symantec Corporation) – C:\WINDOWS\System32\drivers\SYMEVENT.SYS
[2010/12/06 17:42:57 | 000,060,808 | —- | M] (Symantec Corporation) – C:\WINDOWS\System32\S32EVNT1.DLL
[2010/12/06 17:42:57 | 000,007,456 | —- | M] () – C:\WINDOWS\System32\drivers\SYMEVENT.CAT
[2010/12/06 17:42:57 | 000,000,805 | —- | M] () – C:\WINDOWS\System32\drivers\SYMEVENT.INF
[2010/12/06 17:42:50 | 000,001,885 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Norton AntiVirus.LNK
[2010/12/06 17:33:01 | 000,000,432 | —- | M] () – C:\WINDOWS\tasks\At17.job
[2010/12/06 16:27:00 | 000,001,678 | —- | M] () – C:\Documents and Settings\All Users\Desktop\SUPERAntiSpyware Free Edition.lnk
[2010/12/06 16:04:16 | 000,001,734 | —- | M] () – C:\Documents and Settings\Owner\Desktop\HijackThis.lnk
[2010/12/06 16:00:51 | 000,000,432 | —- | M] () – C:\WINDOWS\tasks\At16.job
[2010/12/06 15:58:22 | 000,001,493 | —- | M] () – C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Explorer.lnk
[2010/12/06 15:54:19 | 000,507,904 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\winlogon.exe
[2010/12/05 20:14:34 | 000,000,460 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Ron's Note.rtf
[2010/12/05 18:15:15 | 000,000,432 | —- | M] () – C:\WINDOWS\tasks\At18.job
[2010/12/05 17:29:00 | 000,000,802 | —- | M] () – C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes' Anti-Malware.lnk
[2010/12/05 17:29:00 | 000,000,784 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/12/05 16:56:51 | 000,000,010 | —- | M] () – C:\Documents and Settings\Owner\Application Data\install
[2010/12/05 16:56:09 | 000,000,432 | —- | M] () – C:\WINDOWS\tasks\At15.job
[2010/12/05 16:56:09 | 000,000,432 | —- | M] () – C:\WINDOWS\tasks\At14.job
[2010/12/01 13:05:27 | 000,054,156 | -H– | M] () – C:\WINDOWS\QTFont.qfn
[2010/12/01 13:05:27 | 000,001,409 | —- | M] () – C:\WINDOWS\QTFont.for
[2010/11/29 17:42:18 | 000,038,224 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/11/29 17:42:06 | 000,020,952 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2010/11/18 10:37:01 | 000,441,454 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/11/18 10:37:01 | 000,071,264 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/11/16 16:44:24 | 000,010,752 | —- | M] () – C:\Documents and Settings\Owner\My Documents\credit card cancel.wps
[2010/11/16 16:44:24 | 000,000,548 | —- | M] () – C:\Documents and Settings\Owner\Application Data\wklnhst.dat
[2010/11/10 09:50:13 | 000,000,457 | —- | M] () – C:\Documents and Settings\Owner\My Documents\new credit card.rtf
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/12/07 10:56:46 | 000,000,364 | —- | C] () – C:\Documents and Settings\Owner\Desktop\IE.reg
[2010/12/07 10:51:17 | 000,000,449 | —- | C] () – C:\Documents and Settings\Owner\Desktop\Shortcut to Anti Virus Cleanup tools.lnk
[2010/12/07 10:50:49 | 000,000,449 | —- | C] () – C:\Shortcut to Anti Virus Cleanup tools.lnk
[2010/12/07 09:24:11 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/12/07 09:13:01 | 000,014,739 | —- | C] () – C:\WINDOWS\System32\12543.js
[2010/12/06 18:10:15 | 000,002,239 | —- | C] () – C:\Documents and Settings\All Users\Desktop\The Print Shop 22.lnk
[2010/12/06 17:43:13 | 000,650,860 | —- | C] () – C:\WINDOWS\System32\drivers\NAV\1201000.025\Cat.DB
[2010/12/06 17:42:57 | 000,007,456 | —- | C] () – C:\WINDOWS\System32\drivers\SYMEVENT.CAT
[2010/12/06 17:42:57 | 000,000,805 | —- | C] () – C:\WINDOWS\System32\drivers\SYMEVENT.INF
[2010/12/06 17:42:50 | 000,001,885 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Norton AntiVirus.LNK
[2010/12/06 17:42:37 | 000,003,373 | R— | C] () – C:\WINDOWS\System32\drivers\NAV\1201000.025\SymEFA.inf
[2010/12/06 17:42:37 | 000,002,792 | R— | C] () – C:\WINDOWS\System32\drivers\NAV\1201000.025\SymDS.inf
[2010/12/06 17:42:37 | 000,001,473 | R— | C] () – C:\WINDOWS\System32\drivers\NAV\1201000.025\SymNetV.inf
[2010/12/06 17:42:37 | 000,001,445 | R— | C] () – C:\WINDOWS\System32\drivers\NAV\1201000.025\SymNet.inf
[2010/12/06 17:42:37 | 000,001,389 | R— | C] () – C:\WINDOWS\System32\drivers\NAV\1201000.025\srtspx.inf
[2010/12/06 17:42:37 | 000,001,383 | R— | C] () – C:\WINDOWS\System32\drivers\NAV\1201000.025\srtsp.inf
[2010/12/06 17:42:37 | 000,000,741 | R— | C] () – C:\WINDOWS\System32\drivers\NAV\1201000.025\Iron.inf
[2010/12/06 17:42:28 | 000,007,787 | R— | C] () – C:\WINDOWS\System32\drivers\NAV\1201000.025\symnetv.cat
[2010/12/06 17:42:28 | 000,007,446 | R— | C] () – C:\WINDOWS\System32\drivers\NAV\1201000.025\SymNet.cat
[2010/12/06 17:42:28 | 000,007,444 | R— | C] () – C:\WINDOWS\System32\drivers\NAV\1201000.025\SymEFA.cat
[2010/12/06 17:42:28 | 000,007,442 | R— | C] () – C:\WINDOWS\System32\drivers\NAV\1201000.025\srtspx.cat
[2010/12/06 17:42:28 | 000,007,438 | R— | C] () – C:\WINDOWS\System32\drivers\NAV\1201000.025\SymDS.cat
[2010/12/06 17:42:28 | 000,007,438 | R— | C] () – C:\WINDOWS\System32\drivers\NAV\1201000.025\srtsp.cat
[2010/12/06 17:42:28 | 000,007,438 | R— | C] () – C:\WINDOWS\System32\drivers\NAV\1201000.025\iron.cat
[2010/12/06 17:42:28 | 000,000,172 | —- | C] () – C:\WINDOWS\System32\drivers\NAV\1201000.025\isolate.ini
[2010/12/06 16:27:00 | 000,001,678 | —- | C] () – C:\Documents and Settings\All Users\Desktop\SUPERAntiSpyware Free Edition.lnk
[2010/12/06 16:04:16 | 000,001,734 | —- | C] () – C:\Documents and Settings\Owner\Desktop\HijackThis.lnk
[2010/12/06 15:43:38 | 000,265,069 | —- | C] () – C:\WINDOWS\System32\WINLOGON.EX_
[2010/12/06 15:41:45 | 000,265,069 | —- | C] () – C:\WINDOWS\WINLOGON.EX_
[2010/12/06 15:40:56 | 000,356,615 | —- | C] () – C:\WINDOWS\EXPLORER.EX_
[2010/12/06 15:35:43 | 001,033,728 | —- | C] () – C:\WINDOWS\System32\dllcache\explorer.exe
[2010/12/05 20:14:34 | 000,000,460 | —- | C] () – C:\Documents and Settings\Owner\Desktop\Ron's Note.rtf
[2010/12/05 17:29:00 | 000,000,802 | —- | C] () – C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes' Anti-Malware.lnk
[2010/12/05 17:29:00 | 000,000,784 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/12/05 16:56:51 | 000,000,010 | —- | C] () – C:\Documents and Settings\Owner\Application Data\install
[2010/12/05 16:56:09 | 000,000,432 | —- | C] () – C:\WINDOWS\tasks\At24.job
[2010/12/05 16:56:09 | 000,000,432 | —- | C] () – C:\WINDOWS\tasks\At23.job
[2010/12/05 16:56:09 | 000,000,432 | —- | C] () – C:\WINDOWS\tasks\At22.job
[2010/12/05 16:56:09 | 000,000,432 | —- | C] () – C:\WINDOWS\tasks\At21.job
[2010/12/05 16:56:09 | 000,000,432 | —- | C] () – C:\WINDOWS\tasks\At20.job
[2010/12/05 16:56:09 | 000,000,432 | —- | C] () – C:\WINDOWS\tasks\At19.job
[2010/12/05 16:56:09 | 000,000,432 | —- | C] () – C:\WINDOWS\tasks\At18.job
[2010/12/05 16:56:09 | 000,000,432 | —- | C] () – C:\WINDOWS\tasks\At17.job
[2010/12/05 16:56:08 | 000,000,432 | —- | C] () – C:\WINDOWS\tasks\At9.job
[2010/12/05 16:56:08 | 000,000,432 | —- | C] () – C:\WINDOWS\tasks\At8.job
[2010/12/05 16:56:08 | 000,000,432 | —- | C] () – C:\WINDOWS\tasks\At7.job
[2010/12/05 16:56:08 | 000,000,432 | —- | C] () – C:\WINDOWS\tasks\At6.job
[2010/12/05 16:56:08 | 000,000,432 | —- | C] () – C:\WINDOWS\tasks\At5.job
[2010/12/05 16:56:08 | 000,000,432 | —- | C] () – C:\WINDOWS\tasks\At4.job
[2010/12/05 16:56:08 | 000,000,432 | —- | C] () – C:\WINDOWS\tasks\At3.job
[2010/12/05 16:56:08 | 000,000,432 | —- | C] () – C:\WINDOWS\tasks\At2.job
[2010/12/05 16:56:08 | 000,000,432 | —- | C] () – C:\WINDOWS\tasks\At16.job
[2010/12/05 16:56:08 | 000,000,432 | —- | C] () – C:\WINDOWS\tasks\At15.job
[2010/12/05 16:56:08 | 000,000,432 | —- | C] () – C:\WINDOWS\tasks\At14.job
[2010/12/05 16:56:08 | 000,000,432 | —- | C] () – C:\WINDOWS\tasks\At13.job
[2010/12/05 16:56:08 | 000,000,432 | —- | C] () – C:\WINDOWS\tasks\At12.job
[2010/12/05 16:56:08 | 000,000,432 | —- | C] () – C:\WINDOWS\tasks\At11.job
[2010/12/05 16:56:08 | 000,000,432 | —- | C] () – C:\WINDOWS\tasks\At10.job
[2010/12/05 16:56:08 | 000,000,432 | —- | C] () – C:\WINDOWS\tasks\At1.job
[2010/12/01 13:05:27 | 000,054,156 | -H– | C] () – C:\WINDOWS\QTFont.qfn
[2010/12/01 13:05:27 | 000,001,409 | —- | C] () – C:\WINDOWS\QTFont.for
[2010/11/16 16:44:24 | 000,010,752 | —- | C] () – C:\Documents and Settings\Owner\My Documents\credit card cancel.wps
[2010/11/10 09:50:13 | 000,000,457 | —- | C] () – C:\Documents and Settings\Owner\My Documents\new credit card.rtf
[2010/06/23 13:10:38 | 000,000,049 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2009/10/06 14:55:47 | 000,008,704 | —- | C] () – C:\WINDOWS\System32\CNMVS75.DLL
[2009/10/06 10:25:30 | 000,000,548 | —- | C] () – C:\Documents and Settings\Owner\Application Data\wklnhst.dat
[2009/10/05 22:51:07 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2009/10/05 19:17:25 | 000,000,002 | —- | C] () – C:\WINDOWS\msoffice.ini
[2009/10/05 18:55:30 | 000,156,672 | —- | C] () – C:\WINDOWS\System32\RTLCPAPI.dll
[2009/03/03 11:18:04 | 000,073,728 | —- | C] () – C:\WINDOWS\System32\RtNicProp32.dll
[2008/01/14 17:47:06 | 000,099,712 | —- | C] () – C:\WINDOWS\HPBroker.dll
[2005/03/27 02:10:58 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2005/03/23 11:53:24 | 000,001,416 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2005/03/23 11:53:24 | 000,000,480 | —- | C] () – C:\WINDOWS\System32\emver.ini
[2005/03/23 11:52:36 | 000,249,270 | —- | C] () – C:\WINDOWS\System32\_002742_.tmp.dll
[2005/03/23 05:03:51 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI

========== LOP Check ==========

[2010/12/06 10:54:59 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AT&T
[2010/12/06 18:15:49 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Broderbund Software
[2009/10/06 14:55:41 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\CanonBJ
[2009/10/05 19:30:04 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Napster
[2010/06/14 14:59:49 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Thought Communications
[2010/12/06 10:54:59 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\AT&T
[2010/05/14 16:06:55 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\FCSB000062035
[2010/05/14 16:07:14 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\FinalMediaPlayer
[2010/06/14 15:31:59 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\ImgBurn
[2009/12/21 16:13:36 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\OpenOffice.org
[2010/12/06 16:02:32 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\PriceGong
[2009/10/05 18:55:45 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\SampleView
[2009/10/06 10:28:35 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Template
[2010/12/06 14:33:22 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Tific
[2010/05/14 16:07:38 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\WeatherBug
[2010/12/07 09:54:11 | 000,000,432 | —- | M] () – C:\WINDOWS\Tasks\At1.job
[2010/12/07 09:13:01 | 000,000,432 | —- | M] () – C:\WINDOWS\Tasks\At10.job
[2010/12/07 10:26:28 | 000,000,432 | —- | M] () – C:\WINDOWS\Tasks\At11.job
[2010/12/07 11:13:15 | 000,000,432 | —- | M] () – C:\WINDOWS\Tasks\At12.job
[2010/12/07 12:13:03 | 000,000,432 | —- | M] () – C:\WINDOWS\Tasks\At13.job
[2010/12/05 16:56:09 | 000,000,432 | —- | M] () – C:\WINDOWS\Tasks\At14.job
[2010/12/05 16:56:09 | 000,000,432 | —- | M] () – C:\WINDOWS\Tasks\At15.job
[2010/12/06 16:00:51 | 000,000,432 | —- | M] () – C:\WINDOWS\Tasks\At16.job
[2010/12/06 17:33:01 | 000,000,432 | —- | M] () – C:\WINDOWS\Tasks\At17.job
[2010/12/05 18:15:15 | 000,000,432 | —- | M] () – C:\WINDOWS\Tasks\At18.job
[2010/12/07 09:54:11 | 000,000,432 | —- | M] () – C:\WINDOWS\Tasks\At19.job
[2010/12/07 09:54:11 | 000,000,432 | —- | M] () – C:\WINDOWS\Tasks\At2.job
[2010/12/07 09:54:11 | 000,000,432 | —- | M] () – C:\WINDOWS\Tasks\At20.job
[2010/12/07 09:54:11 | 000,000,432 | —- | M] () – C:\WINDOWS\Tasks\At21.job
[2010/12/07 09:54:11 | 000,000,432 | —- | M] () – C:\WINDOWS\Tasks\At22.job
[2010/12/07 09:54:11 | 000,000,432 | —- | M] () – C:\WINDOWS\Tasks\At23.job
[2010/12/07 09:54:11 | 000,000,432 | —- | M] () – C:\WINDOWS\Tasks\At24.job
[2010/12/07 09:54:11 | 000,000,432 | —- | M] () – C:\WINDOWS\Tasks\At3.job
[2010/12/07 09:54:11 | 000,000,432 | —- | M] () – C:\WINDOWS\Tasks\At4.job
[2010/12/07 09:54:11 | 000,000,432 | —- | M] () – C:\WINDOWS\Tasks\At5.job
[2010/12/07 09:54:11 | 000,000,432 | —- | M] () – C:\WINDOWS\Tasks\At6.job
[2010/12/07 09:54:11 | 000,000,432 | —- | M] () – C:\WINDOWS\Tasks\At7.job
[2010/12/07 09:54:11 | 000,000,432 | —- | M] () – C:\WINDOWS\Tasks\At8.job
[2010/12/07 09:54:11 | 000,000,432 | —- | M] () – C:\WINDOWS\Tasks\At9.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2009/10/05 18:56:03 | 000,000,193 | —- | M] () – C:\audio.log
[2005/03/23 13:13:17 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2009/10/05 22:28:49 | 000,000,211 | RHS- | M] () – C:\boot.ini
[2005/03/23 13:13:17 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2010/06/14 14:17:35 | 000,000,182 | —- | M] () – C:\drwtsn32.log
[2005/03/23 13:13:17 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2009/10/05 22:47:10 | 000,000,869 | -H– | M] () – C:\IPH.PH
[2009/10/05 21:16:34 | 000,000,060 | —- | M] () – C:\MOVE_RECOVERY
[2005/03/23 13:13:17 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2009/10/05 18:55:19 | 000,000,160 | —- | M] () – C:\napster.log
[2004/08/04 14:00:00 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2009/10/05 20:14:17 | 000,250,048 | RHS- | M] () – C:\ntldr
[2010/12/07 10:26:15 | 603,979,776 | -HS- | M] () – C:\pagefile.sys
[2010/12/07 10:52:24 | 000,000,359 | —- | M] () – C:\rkill.log
[2010/12/07 10:50:49 | 000,000,449 | —- | M] () – C:\Shortcut to Anti Virus Cleanup tools.lnk

< %systemroot%\Fonts\*.com >
[2006/04/18 14:39:28 | 000,026,040 | —- | M] () – C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 13:53:56 | 000,026,489 | —- | M] () – C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 14:39:28 | 000,029,779 | —- | M] () – C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 13:58:52 | 000,030,808 | —- | M] () – C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2005/03/23 13:12:36 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2006/07/11 04:00:00 | 000,020,992 | —- | M] (CANON INC.) – C:\WINDOWS\system32\spool\prtprocs\w32x86\CNMPD75.DLL
[2006/07/11 04:00:00 | 000,059,392 | —- | M] (CANON INC.) – C:\WINDOWS\system32\spool\prtprocs\w32x86\CNMPP75.DLL
[2008/07/06 07:06:10 | 000,089,088 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2004/03/22 17:17:06 | 000,025,840 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll
[2008/07/06 05:50:03 | 000,597,504 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2005/03/23 05:02:03 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2005/03/23 05:02:03 | 000,634,880 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2005/03/23 05:02:03 | 000,851,968 | —- | M] () – C:\WINDOWS\system32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2009/10/05 20:20:31 | 000,000,272 | -HS- | M] () – C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2009/10/05 20:56:16 | 000,000,119 | -HS- | M] () – C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2005/03/23 13:18:31 | 000,000,079 | —- | M] () – C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-12-07 08:00:13

< End of report >

Extras.txt -

OTL Extras logfile created on: 12/7/2010 12:42:32 PM - Run 1
OTL by OldTimer - Version 3.2.17.3 Folder = C:\Anti Virus Cleanup tools
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 51.00% Memory free
2.00 Gb Paging File | 1.00 Gb Available in Paging File | 64.00% Paging File free
Paging file location(s): C:\pagefile.sys 576 1152 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 145.97 Gb Total Space | 112.51 Gb Free Space | 77.08% Space Free | Partition Type: NTFS
Drive D: | 3.07 Gb Total Space | 0.85 Gb Free Space | 27.59% Space Free | Partition Type: FAT32

Computer Name: E-MACHINE | User Name: Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
htmlfile – Reg Error: Key error.
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 4

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" = C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL – File not found
"C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe" = C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:*:Enabled:AOL – File not found
"C:\Program Files\America Online 9.0\waol.exe" = C:\Program Files\America Online 9.0\waol.exe:*:Enabled:AOL – File not found

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" = C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL – File not found
"C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe" = C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:*:Enabled:AOL – File not found
"C:\Program Files\America Online 9.0\waol.exe" = C:\Program Files\America Online 9.0\waol.exe:*:Enabled:AOL – File not found


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{055EE59D-217B-43A7-ABFF-507B966405D8}" = ATI Catalyst Control Center
"{0893078B-8A9A-84D6-D393-119B9B0B033A}" = CCC Help French
"{0BEDBD4E-2D34-47B5-9973-57E62B29307C}" = ATI Control Panel
"{0E2A60F7-2907-5718-FF16-7D8FAF70051E}" = CCC Help Chinese Standard
"{14FAE013-AE19-4FC9-B5BF-E56ADC01ECE6}" = CCC Help Turkish
"{15377C3E-9655-400F-B441-E69F0A6BEAFE}" = Recovery Software Suite eMachines
"{17BB2784-6EE4-D7FF-FE63-58A3AD2B3708}" = CCC Help Russian
"{233588CF-96D5-46AF-EF74-7EC382662791}" = Catalyst Control Center Graphics Full Existing
"{26A24AE4-039D-4CA4-87B4-2F83216016F0}" = Java™ 6 Update 16
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java™ 6 Update 22
"{3260ECBC-9DDF-E7A3-0863-449473BC7BD5}" = CCC Help Chinese Traditional
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{39C6C229-CFFD-639E-229A-E463FCD87478}" = CCC Help German
"{416D80BA-6F6D-4672-B7CF-F54DA2F80B44}" = Microsoft Works
"{4477B161-C8F1-42D3-85B0-2037760CA86C}" = FaxTalk Communicator SE 4.7
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4F11FC80-CE8C-1BD4-5C39-EBE5744E5135}" = CCC Help Portuguese
"{4FAB2BA7-E16C-95D2-F326-60A68409373F}" = Catalyst Control Center HydraVision Full
"{529AA9A8-5020-6CFB-A809-BC5943C87077}" = CCC Help Thai
"{53604297-26FD-516D-6FF7-1063BA64A0A4}" = Catalyst Control Center Graphics Light
"{55BD3B0B-F054-9341-514F-295A5F7EA450}" = CCC Help Spanish
"{5A13987D-55F4-4271-A40E-76AC9B1B38FD}" = OpenOffice.org 3.2
"{5A4FA9C8-ED56-08C3-153B-FC5C19256290}" = CCC Help Dutch
"{5B56FED7-B4F7-4530-9259-BF9BE5034FB3}" = FaxTalk Messenger Pro 8
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{68E0144E-5EBB-4002-9ACF-AA2E9DFCF1ED}" = Eudora
"{6C390D51-E5F0-4FCD-24C4-731ACAF34571}" = CCC Help Japanese
"{7AA8FA9A-1656-7DBD-633B-FE7A62BBED0C}" = CCC Help Czech
"{81EED1A1-AE78-4B11-BE47-C6AE9F5E87F1}" = Digital Media Reader
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C22131B-8634-CECF-F0D1-A2ECC160B450}" = CCC Help Norwegian
"{8F018A9E-56DE-4A79-A5EF-25F413F1D538}" = WeatherBug
"{90FBE4D0-2ACA-A8A8-2CC4-CFFBAE528504}" = CCC Help Finnish
"{9D74375E-3012-E7D2-9229-B220C91F326A}" = Catalyst Control Center Core Implementation
"{9EE8BDCA-7505-4895-D91E-8108DD16292E}" = CCC Help English
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A8AF8BD3-61B5-7945-4D1B-217421F604FC}" = CCC Help Hungarian
"{AA46E1C5-A709-6D9B-D99D-92E4C6E042A9}" = CCC Help Korean
"{AA62A33C-9E5E-3913-7D88-7E58A8CB1493}" = CCC Help Greek
"{AC76BA86-7AD7-1033-7B44-A91000000001}" = Adobe Reader 9.1.3
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{B653F643-A1B4-9936-2DB6-FEA9A3110D8D}" = ccc-core-preinstall
"{B71C4637-0247-78CE-6A3D-D61645CB8921}" = ccc-utility
"{BC2E7C0B-1AC6-5F6C-F31D-E1E72D8E0B5C}" = CCC Help Danish
"{BF8C7DA7-2DE6-ED67-6C82-6BE82F8BA8D3}" = Catalyst Control Center Graphics Full New
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C409F338-BB20-6C4A-F40D-20CA07AF714C}" = CCC Help Polish
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D4B7B2DC-E688-A9D6-6EC0-56AE540E074C}" = Catalyst Control Center Localization All
"{D9CD701B-3F04-FC69-D974-F3A7F5E9BA30}" = CCC Help Swedish
"{D9D93D74-107D-4BD3-87D0-AABCF7C98BD5}" = Catalyst Control Center - Branding
"{E213321B-1E88-B38D-DAB2-D8CB9355984A}" = Skins
"{E7B100D8-98A5-42AA-830F-16D6BD5351F1}" = My.Freeze.com NetAssistant
"{F06802C4-C45A-4B56-B05A-4C8F3E963431}" = The Print Shop 22
"{F4148D8F-ED3A-3097-509C-04D5560220F9}" = ccc-core-static
"{F7E68997-E626-952B-A7BF-F72066CD5D77}" = Catalyst Control Center Graphics Previews Common
"{FA36C82B-464D-51F2-A6A1-0BC9140BE067}" = CCC Help Italian
"{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Agere Systems Soft Modem" = Agere Systems PCI-SV92PP Soft Modem
"All ATI Software" = ATI - Software Uninstall Utility
"ATI Display Driver" = ATI Display Driver
"CANONBJ_Deinstall_CNMCP75.DLL" = Canon iP1600
"Carbonite Setup Lite" = Carbonite Online Backup Setup
"GoToAssist Express Customer" = GoToAssist Customer 1.5.0.258
"HijackThis" = HijackThis 2.0.2
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ImgBurn" = ImgBurn
"InstallShield_{81EED1A1-AE78-4B11-BE47-C6AE9F5E87F1}" = Digital Media Reader
"IrfanView" = IrfanView (remove only)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Money2005b" = Microsoft Money 2005
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NAV" = Norton AntiVirus
"Nero - Burning Rom!UninstallKey" = Nero OEM
"Nero BurnRights!UninstallKey" = Nero BurnRights
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"QuickTime" = QuickTime
"StreetPlugin" = Learn2 Player (Uninstall Only)
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"WebPost" = Microsoft Web Publishing Wizard 1.52
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"Yahoo! Companion" = Yahoo! Toolbar
"Yahoo! Software Update" = Yahoo! Software Update

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 7/28/2010 1:15:03 PM | Computer Name = E-MACHINE | Source = Application Hang | ID = 1001
Description = Fault bucket 539595219.

Error - 10/16/2010 12:58:40 PM | Computer Name = E-MACHINE | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 7.0.6000.17091, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 10/16/2010 12:58:42 PM | Computer Name = E-MACHINE | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 7.0.6000.17091, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 10/16/2010 12:58:56 PM | Computer Name = E-MACHINE | Source = Application Hang | ID = 1002
Description = Hanging application FTmsgr32.exe, version 8.0.0.1610, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 10/19/2010 2:21:02 PM | Computer Name = E-MACHINE | Source = Application Hang | ID = 1002
Description = Hanging application i_view32.exe, version 4.1.0.0, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 10/19/2010 2:21:14 PM | Computer Name = E-MACHINE | Source = Application Hang | ID = 1002
Description = Hanging application i_view32.exe, version 4.1.0.0, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 10/19/2010 2:21:20 PM | Computer Name = E-MACHINE | Source = Application Hang | ID = 1002
Description = Hanging application i_view32.exe, version 4.1.0.0, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 11/18/2010 7:23:51 PM | Computer Name = E-MACHINE | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 7.0.6000.17091, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 12/6/2010 11:53:11 AM | Computer Name = E-MACHINE | Source = WinMgmt | ID = 24
Description = Event provider attempted to register query "SELECT * FROM PDEvent"
whose target class "PDEvent" does not exist. The query will be ignored.

Error - 12/7/2010 10:53:52 AM | Computer Name = E-MACHINE | Source = Application Error | ID = 1000
Description = Faulting application svchost.exe, version 5.1.2600.5512, faulting
module ntdll.dll, version 5.1.2600.5755, fault address 0x00023845.

[ System Events ]
Error - 12/7/2010 1:27:19 PM | Computer Name = E-MACHINE | Source = DCOM | ID = 10005
Description = DCOM got error "%1058" attempting to start the service YahooAUService
with arguments "" in order to run the server: {3D369E3A-9EDF-46C4-B4BC-47BF3304BF7C}

Error - 12/7/2010 1:27:27 PM | Computer Name = E-MACHINE | Source = DCOM | ID = 10005
Description = DCOM got error "%1058" attempting to start the service YahooAUService
with arguments "" in order to run the server: {90AFF435-B544-4F94-A0C2-CC020EACA4E3}

Error - 12/7/2010 1:27:27 PM | Computer Name = E-MACHINE | Source = DCOM | ID = 10005
Description = DCOM got error "%1058" attempting to start the service YahooAUService
with arguments "" in order to run the server: {90AFF435-B544-4F94-A0C2-CC020EACA4E3}

Error - 12/7/2010 1:27:27 PM | Computer Name = E-MACHINE | Source = DCOM | ID = 10005
Description = DCOM got error "%1058" attempting to start the service YahooAUService
with arguments "" in order to run the server: {90AFF435-B544-4F94-A0C2-CC020EACA4E3}

Error - 12/7/2010 1:35:31 PM | Computer Name = E-MACHINE | Source = DCOM | ID = 10005
Description = DCOM got error "%1058" attempting to start the service YahooAUService
with arguments "" in order to run the server: {90AFF435-B544-4F94-A0C2-CC020EACA4E3}

Error - 12/7/2010 1:35:31 PM | Computer Name = E-MACHINE | Source = DCOM | ID = 10005
Description = DCOM got error "%1058" attempting to start the service YahooAUService
with arguments "" in order to run the server: {90AFF435-B544-4F94-A0C2-CC020EACA4E3}

Error - 12/7/2010 1:35:31 PM | Computer Name = E-MACHINE | Source = DCOM | ID = 10005
Description = DCOM got error "%1058" attempting to start the service YahooAUService
with arguments "" in order to run the server: {90AFF435-B544-4F94-A0C2-CC020EACA4E3}

Error - 12/7/2010 1:35:44 PM | Computer Name = E-MACHINE | Source = DCOM | ID = 10005
Description = DCOM got error "%1058" attempting to start the service YahooAUService
with arguments "" in order to run the server: {90AFF435-B544-4F94-A0C2-CC020EACA4E3}

Error - 12/7/2010 1:42:52 PM | Computer Name = E-MACHINE | Source = SRService | ID = 104
Description = The System Restore initialization process failed.

Error - 12/7/2010 1:42:53 PM | Computer Name = E-MACHINE | Source = Service Control Manager | ID = 7023
Description = The System Restore Service service terminated with the following error:
%%2


< End of report >

Thanks in advance for your help.

Here is the ComboFix log file:

ComboFix 10-12-06.04 - Owner 12/07/2010 16:14:10.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1918.1516 [GMT -5:00]
Running from: c:\anti virus cleanup tools\ComboFix.exe
AV: Norton AntiVirus *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Owner\Application Data\install
c:\documents and settings\Owner\Application Data\PriceGong
c:\documents and settings\Owner\Application Data\PriceGong\Data\1.xml
c:\documents and settings\Owner\Application Data\PriceGong\Data\a.xml
c:\documents and settings\Owner\Application Data\PriceGong\Data\b.xml
c:\documents and settings\Owner\Application Data\PriceGong\Data\c.xml
c:\documents and settings\Owner\Application Data\PriceGong\Data\d.xml
c:\documents and settings\Owner\Application Data\PriceGong\Data\e.xml
c:\documents and settings\Owner\Application Data\PriceGong\Data\f.xml
c:\documents and settings\Owner\Application Data\PriceGong\Data\g.xml
c:\documents and settings\Owner\Application Data\PriceGong\Data\h.xml
c:\documents and settings\Owner\Application Data\PriceGong\Data\i.xml
c:\documents and settings\Owner\Application Data\PriceGong\Data\J.xml
c:\documents and settings\Owner\Application Data\PriceGong\Data\k.xml
c:\documents and settings\Owner\Application Data\PriceGong\Data\l.xml
c:\documents and settings\Owner\Application Data\PriceGong\Data\m.xml
c:\documents and settings\Owner\Application Data\PriceGong\Data\mru.xml
c:\documents and settings\Owner\Application Data\PriceGong\Data\n.xml
c:\documents and settings\Owner\Application Data\PriceGong\Data\o.xml
c:\documents and settings\Owner\Application Data\PriceGong\Data\p.xml
c:\documents and settings\Owner\Application Data\PriceGong\Data\q.xml
c:\documents and settings\Owner\Application Data\PriceGong\Data\r.xml
c:\documents and settings\Owner\Application Data\PriceGong\Data\s.xml
c:\documents and settings\Owner\Application Data\PriceGong\Data\t.xml
c:\documents and settings\Owner\Application Data\PriceGong\Data\u.xml
c:\documents and settings\Owner\Application Data\PriceGong\Data\v.xml
c:\documents and settings\Owner\Application Data\PriceGong\Data\w.xml
c:\documents and settings\Owner\Application Data\PriceGong\Data\x.xml
c:\documents and settings\Owner\Application Data\PriceGong\Data\y.xml
c:\documents and settings\Owner\Application Data\PriceGong\Data\z.xml
c:\documents and settings\Owner\g2ax_customer_downloadhelper_win32_x86.exe
c:\windows\system32\_002741_.tmp.dll
c:\windows\system32\_002742_.tmp.dll
c:\windows\system32\_002743_.tmp.dll
c:\windows\Tasks\At1.job
c:\windows\Tasks\At10.job
c:\windows\Tasks\At11.job
c:\windows\Tasks\At12.job
c:\windows\Tasks\At13.job
c:\windows\Tasks\At14.job
c:\windows\Tasks\At15.job
c:\windows\Tasks\At16.job
c:\windows\Tasks\At17.job
c:\windows\Tasks\At18.job
c:\windows\Tasks\At19.job
c:\windows\Tasks\At2.job
c:\windows\Tasks\At20.job
c:\windows\Tasks\At21.job
c:\windows\Tasks\At22.job
c:\windows\Tasks\At23.job
c:\windows\Tasks\At24.job
c:\windows\Tasks\At3.job
c:\windows\Tasks\At4.job
c:\windows\Tasks\At5.job
c:\windows\Tasks\At6.job
c:\windows\Tasks\At7.job
c:\windows\Tasks\At8.job
c:\windows\Tasks\At9.job
D:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2010-11-07 to 2010-12-07 )))))))))))))))))))))))))))))))
.

2010-12-06 23:15 . 2010-12-06 23:15 ——– d—–w- c:\documents and settings\Owner\Local Settings\Application Data\Broderbund Software
2010-12-06 23:15 . 2010-12-06 23:15 ——– d—–w- c:\documents and settings\All Users\Application Data\Broderbund Software
2010-12-06 23:11 . 2004-10-08 01:16 35840 —-a-w- c:\windows\system32\drivers\AFS2K.SYS
2010-12-06 23:10 . 2010-12-07 15:37 ——– d—–w- c:\program files\Web Publish
2010-12-06 23:10 . 2003-07-08 18:45 970752 —-a-w- c:\windows\system32\cdintf210.dll
2010-12-06 23:01 . 2010-12-06 23:02 ——– d—–w- c:\program files\Common Files\Broderbund
2010-12-06 23:01 . 2010-12-06 23:15 ——– d—–w- c:\program files\The Print Shop 22
2010-12-06 22:42 . 2010-12-06 23:12 ——– d—–w- c:\program files\Common Files\Symantec Shared
2010-12-06 22:42 . 2010-12-06 22:42 60808 —-a-w- c:\windows\system32\S32EVNT1.DLL
2010-12-06 22:42 . 2010-12-06 22:42 126512 —-a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2010-12-06 22:42 . 2010-12-06 22:42 ——– d—–w- c:\program files\Symantec
2010-12-06 22:42 . 2010-07-29 03:33 666672 —-a-r- c:\windows\system32\drivers\SymEFA.sys
2010-12-06 22:42 . 2010-07-29 02:54 50096 —-a-r- c:\windows\system32\drivers\srtspx.sys
2010-12-06 22:42 . 2010-07-13 01:20 369072 —-a-r- c:\windows\system32\drivers\symtdi.sys
2010-12-06 22:42 . 2010-06-27 04:05 134704 —-a-r- c:\windows\system32\drivers\Ironx86.sys
2010-12-06 22:42 . 2010-06-13 10:50 339504 —-a-r- c:\windows\system32\drivers\SymDS.sys
2010-12-06 22:42 . 2010-12-06 22:42 ——– d—–w- c:\windows\system32\drivers\NAV
2010-12-06 22:42 . 2010-12-06 22:42 ——– d—–w- c:\program files\Norton AntiVirus
2010-12-06 22:41 . 2010-12-06 22:41 ——– d—–w- c:\program files\NortonInstaller
2010-12-06 21:58 . 2010-12-06 21:58 ——– d—–w- C:\NBRT
2010-12-06 21:27 . 2010-12-06 21:27 ——– d—–w- c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com
2010-12-06 21:27 . 2010-12-06 21:27 ——– d—–w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2010-12-06 21:26 . 2010-12-06 21:27 ——– d—–w- c:\program files\SUPERAntiSpyware
2010-12-06 21:04 . 2010-12-06 21:04 ——– d—–w- c:\program files\Trend Micro
2010-12-06 20:40 . 2008-04-14 12:00 15872 —-a-w- c:\windows\EXPAND.EXE
2010-12-06 20:35 . 2008-04-14 10:42 1033728 —-a-w- c:\windows\system32\dllcache\explorer.exe
2010-12-06 20:35 . 2008-04-14 10:42 1033728 —-a-w- c:\windows\explorer.exe
2010-12-06 19:33 . 2010-12-06 19:33 ——– d—–w- c:\documents and settings\Owner\Application Data\Tific
2010-12-06 19:33 . 2010-12-06 19:33 ——– d—–w- c:\documents and settings\Owner\Local Settings\Application Data\Symantec
2010-12-06 16:38 . 2010-12-06 16:38 ——– d—–w- c:\program files\Common Files\Java
2010-12-06 16:37 . 2010-12-06 16:37 ——– d—–w- c:\program files\Carbonite
2010-12-06 16:31 . 2010-12-06 16:31 ——– d—–w- c:\program files\Windows Sidebar
2010-12-06 16:31 . 2010-12-06 22:42 ——– d—–w- c:\documents and settings\All Users\Application Data\Norton
2010-12-05 22:29 . 2010-12-05 22:29 ——– d—–w- c:\documents and settings\Owner\Application Data\Malwarebytes
2010-12-05 22:29 . 2010-11-29 22:42 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-12-05 22:28 . 2010-12-05 22:28 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-12-05 22:28 . 2010-12-05 22:29 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-12-05 22:28 . 2010-11-29 22:42 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-12-05 22:07 . 2010-12-07 20:46 ——– d—–w- C:\Anti Virus Cleanup tools
2010-12-01 18:05 . 2010-12-01 18:05 1409 —-a-w- c:\windows\QTFont.for

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-12-06 20:54 . 2005-03-23 16:53 507904 —-a-w- c:\windows\system32\winlogon.exe
2010-12-06 20:11 . 2005-03-23 16:53 507904 —-a-w- c:\windows\system32\winlogon.exe.bak
2010-09-18 16:23 . 2005-03-23 16:52 974848 —-a-w- c:\windows\system32\mfc42u.dll
2010-09-18 06:53 . 2005-03-23 16:52 974848 —-a-w- c:\windows\system32\mfc42.dll
2010-09-18 06:53 . 2005-03-23 16:52 954368 —-a-w- c:\windows\system32\mfc40.dll
2010-09-18 06:53 . 2005-03-23 16:52 953856 —-a-w- c:\windows\system32\mfc40u.dll
2010-09-15 09:50 . 2010-06-14 19:46 472808 —-a-w- c:\windows\system32\deployJava1.dll
2010-09-15 07:29 . 2009-10-06 02:42 73728 —-a-w- c:\windows\system32\javacpl.cpl
2010-09-09 13:38 . 2005-03-23 16:53 832512 —-a-w- c:\windows\system32\wininet.dll
2010-09-09 13:38 . 2005-03-23 16:52 1830912 ——w- c:\windows\system32\inetcpl.cpl
2010-09-09 13:38 . 2005-03-23 16:52 78336 —-a-w- c:\windows\system32\ieencode.dll
2010-09-09 13:38 . 2005-03-23 16:52 17408 —-a-w- c:\windows\system32\corpol.dll
.

——- Sigcheck ——-

[-] 2010-12-06 . B0FE1EAE4241EDDD570A11DA07BBF8DF . 507904 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\winlogon.exe
[-] 2010-12-06 . B0FE1EAE4241EDDD570A11DA07BBF8DF . 507904 . . [5.1.2600.5512] . . c:\windows\system32\winlogon.exe
[7] 2008-04-14 . ED0EF0A136DEC83DF69F04118870003E . 507904 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\winlogon.exe
[7] 2004-08-04 . 01C3346C241652F43AED8E2149881BFE . 502272 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\winlogon.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Weather"="c:\program files\AWS\WeatherBug\Weather.exe" [2009-12-29 1653248]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2010-11-22 2424560]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunKistEM"="c:\program files\Digital Media Reader\shwiconem.exe" [2004-11-15 135168]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-03-18 339968]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-03 32768]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-14 212992]
"SoundMan"="SOUNDMAN.EXE" [2004-12-01 77824]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-07-21 61440]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-10-06 98304]
"FaxTalk Messenger Pro 8"="c:\program files\FaxTalk\FTClCtrl.exe" [2010-05-20 120152]
"CarboniteSetupLite"="c:\program files\Carbonite\CarbonitePreinstaller.exe" [2010-11-21 283792]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{EDB0E980-90BD-11D4-8599-0008C7D3B6F8}"= "c:\program files\Qualcomm\Eudora\EuShlExt.dll" [2005-11-14 86016]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist Express Customer]
2010-11-06 07:20 147832 —-a-w- c:\program files\Citrix\GoToAssist Express Customer\258\g2ax_winlogon.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-02-27 21:10 35696 —-a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 09:42 1695232 —-a-w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 18:50 155648 —-a-w- c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-10-06 03:49 98304 —-a-w- c:\program files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NAV\1201000.025\SymDS.sys [12/6/2010 5:42 PM 339504]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NAV\1201000.025\SymEFA.sys [12/6/2010 5:42 PM 666672]
R1 BHDrvx86;BHDrvx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\BASHDefs\20101123.003\BHDrvx86.sys [11/22/2010 9:20 PM 691248]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 1:25 PM 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/10/2010 1:41 PM 67656]
R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NAV\1201000.025\Ironx86.sys [12/6/2010 5:42 PM 134704]
R2 FaxTalk Messenger Pro 8;FaxTalk Messenger Pro 8;c:\program files\FaxTalk\FTmsgsvc.exe [5/20/2010 12:01 PM 32600]
R2 GoToAssist Express Customer;GoToAssist Express Customer;c:\program files\Citrix\GoToAssist Express Customer\258\g2ax_service.exe [11/6/2010 2:20 AM 161144]
R2 NAV;Norton AntiVirus;c:\program files\Norton AntiVirus\Engine\18.1.0.37\ccSvcHst.exe [12/6/2010 5:42 PM 126904]
R3 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\IPSDefs\20101201.001\IDSXpx86.sys [12/6/2010 5:46 PM 341944]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.usatoday.com/
uInternet Connection Wizard,ShellNext = "c:\program files\Outlook Express\msimn.exe"
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-12-07 16:26
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: WDC_WD1600BB-22GUC0 rev.08.02D08 -> Harddisk0\DR0 -> \Device\Ide\IdePort4 P4T0L0-16

device: opened successfully
user: MBR read successfully

Disk trace:
called modules: ntkrnlpa.exe catchme.sys CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8A583555]<<
c:\docume~1\Owner\LOCALS~1\Temp\catchme.sys
_asm { PUSH EBP; MOV EBP, ESP; PUSH ECX; MOV EAX, [EBP+0x8]; CMP EAX, [0x8a5897b0]; MOV EAX, [0x8a58982c]; PUSH EBX; PUSH ESI; MOV ESI, [EBP+0xc]; MOV EBX, [ESI+0x60]; PUSH EDI; JNZ 0x20; MOV [EBP+0x8], EAX; }
1 ntkrnlpa!IofCallDriver[0x804EE130] -> \Device\Harddisk0\DR0[0x8A5CCAB8]
3 CLASSPNP[0xBA168FD7] -> ntkrnlpa!IofCallDriver[0x804EE130] -> \Device\00000089[0x8A594990]
5 ACPI[0xB9F7F620] -> ntkrnlpa!IofCallDriver[0x804EE130] -> [0x8A5B8940]
\Driver\atapi[0x8A5AE9A8] -> IRP_MJ_CREATE -> 0x8A583555
kernel: MBR read successfully
_asm { XOR DI, DI; MOV SI, 0x200; MOV SS, DI; MOV SP, 0x7a00; MOV BX, 0x7a0; MOV CX, SI; MOV DS, BX; MOV ES, BX; REP MOVSB ; JMP FAR 0x7a0:0x5f; }
detected disk devices:
\Device\Ide\IdeDeviceP4T0L0-16 -> \??\IDE#DiskWDC_WD1600BB-22GUC0_____________________08.02D08#5&2f2ac0b5&0&0.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found
detected hooks:
\Driver\atapi DriverStartIo -> 0x8A58339B
user & kernel MBR OK
copy of MBR has been found in sector 60 !
Warning: possible TDL3 rootkit infection !

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NAV]
"ImagePath"="\"c:\program files\Norton AntiVirus\Engine\18.1.0.37\ccSvcHst.exe\" /s \"NAV\" /m \"c:\program files\Norton AntiVirus\Engine\18.1.0.37\diMaster.dll\" /prefetch:1"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(676)
c:\windows\system32\WININET.dll
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\Ati2evxx.dll
c:\program files\Citrix\GoToAssist Express Customer\258\g2ax_winlogon.dll

- - - - - - - > 'lsass.exe'(740)
c:\windows\system32\WININET.dll
.
Completion time: 2010-12-07 16:30:43
ComboFix-quarantined-files.txt 2010-12-07 21:30

Pre-Run: 120,647,401,472 bytes free
Post-Run: 120,957,874,176 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

- - End Of File - - 3B090FE07488507A6615421A0A5D75CC

Please download TDSSKiller.zip

• Extract it to your desktop
• Double click TDSSKiller.exe
• Press Start Scan
  
  • Only if Malicious objects are found then ensure Cure is selected
    If suspicious objects are found select skip
  • Then click Continue > Reboot now
• Copy and paste the log in your next reply
  
  • A copy of the log will be saved automatically to the root of the drive (typically C:\)

ComboFix 10-12-07.06 - Owner 12/08/2010 21:17:26.3.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1918.1342 [GMT -5:00]
Running from: c:\anti virus cleanup tools\ComboFix.exe
Command switches used :: c:\anti virus cleanup tools\CFScript.txt
AV: Norton AntiVirus *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
————— FCopy —————

c:\windows\ServicePackFiles\i386\winlogon.exe –> c:\windows\system32\winlogon.exe
c:\windows\ServicePackFiles\i386\winlogon.exe –> c:\windows\system32\dllcache\winlogon.exe
.
((((((((((((((((((((((((( Files Created from 2010-11-09 to 2010-12-09 )))))))))))))))))))))))))))))))
.

2010-12-08 18:22 . 2010-12-08 18:22 ——– d-sh–w- c:\documents and settings\Owner\PrivacIE
2010-12-08 18:15 . 2010-12-08 18:15 ——– d-sh–w- c:\documents and settings\Owner\IETldCache
2010-12-08 18:07 . 2010-12-08 18:07 ——– d–h–w- c:\windows\msdownld.tmp
2010-12-08 16:33 . 2010-12-08 16:33 ——– d—–w- c:\program files\Microsoft.NET
2010-12-08 16:25 . 2010-12-08 16:25 ——– d—–w- c:\windows\system32\winrm
2010-12-08 16:25 . 2010-12-08 16:26 ——– dc-h–w- c:\windows\$968930Uinstall_KB968930$
2010-12-08 16:24 . 2010-10-18 11:10 7680 -c—-w- c:\windows\system32\dllcache\iecompat.dll
2010-12-08 16:18 . 2010-09-10 05:58 916480 ——w- c:\windows\system32\SET1913.tmp
2010-12-08 16:18 . 2010-09-10 05:58 66560 ——w- c:\windows\system32\SET1917.tmp
2010-12-08 16:18 . 2010-09-10 05:58 1210880 ——w- c:\windows\system32\SET1914.tmp
2010-12-08 16:18 . 2010-09-10 05:58 5957120 ——w- c:\windows\system32\SET1918.tmp
2010-12-08 16:18 . 2010-09-10 05:58 602112 ——w- c:\windows\system32\SET191A.tmp
2010-12-08 16:18 . 2010-09-10 05:58 55296 ——w- c:\windows\system32\SET1919.tmp
2010-12-08 16:18 . 2010-09-10 05:58 1986560 ——w- c:\windows\system32\SET191E.tmp
2010-12-08 16:18 . 2010-09-10 05:58 184320 ——w- c:\windows\system32\SET191F.tmp
2010-12-08 16:18 . 2010-09-10 05:58 11080192 ——w- c:\windows\system32\SET1920.tmp
2010-12-08 16:13 . 2010-09-10 05:58 12800 -c—-w- c:\windows\system32\dllcache\xpshims.dll
2010-12-08 16:13 . 2010-09-10 05:58 247808 -c—-w- c:\windows\system32\dllcache\ieproxy.dll
2010-12-08 16:13 . 2010-09-10 05:58 743424 -c—-w- c:\windows\system32\dllcache\iedvtool.dll
2010-12-08 16:06 . 2010-12-08 17:58 ——– dc-h–w- c:\windows\ie8
2010-12-07 21:47 . 2010-12-07 21:54 16968 —-a-w- c:\windows\system32\drivers\hitmanpro35.sys
2010-12-07 21:46 . 2010-12-07 21:46 ——– d—–w- c:\documents and settings\All Users\Application Data\Hitman Pro
2010-12-06 23:15 . 2010-12-06 23:15 ——– d—–w- c:\documents and settings\Owner\Local Settings\Application Data\Broderbund Software
2010-12-06 23:15 . 2010-12-06 23:15 ——– d—–w- c:\documents and settings\All Users\Application Data\Broderbund Software
2010-12-06 23:11 . 2004-10-08 01:16 35840 —-a-w- c:\windows\system32\drivers\AFS2K.SYS
2010-12-06 23:10 . 2010-12-07 15:37 ——– d—–w- c:\program files\Web Publish
2010-12-06 23:10 . 2003-07-08 18:45 970752 —-a-w- c:\windows\system32\cdintf210.dll
2010-12-06 23:01 . 2010-12-06 23:02 ——– d—–w- c:\program files\Common Files\Broderbund
2010-12-06 23:01 . 2010-12-06 23:15 ——– d—–w- c:\program files\The Print Shop 22
2010-12-06 22:42 . 2010-12-06 23:12 ——– d—–w- c:\program files\Common Files\Symantec Shared
2010-12-06 22:42 . 2010-12-06 22:42 60808 —-a-w- c:\windows\system32\S32EVNT1.DLL
2010-12-06 22:42 . 2010-12-06 22:42 126512 —-a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2010-12-06 22:42 . 2010-12-06 22:42 ——– d—–w- c:\program files\Symantec
2010-12-06 22:42 . 2010-07-29 03:33 666672 —-a-r- c:\windows\system32\drivers\SymEFA.sys
2010-12-06 22:42 . 2010-07-29 02:54 50096 —-a-r- c:\windows\system32\drivers\srtspx.sys
2010-12-06 22:42 . 2010-07-13 01:20 369072 —-a-r- c:\windows\system32\drivers\symtdi.sys
2010-12-06 22:42 . 2010-06-27 04:05 134704 —-a-r- c:\windows\system32\drivers\Ironx86.sys
2010-12-06 22:42 . 2010-06-13 10:50 339504 —-a-r- c:\windows\system32\drivers\SymDS.sys
2010-12-06 22:42 . 2010-12-06 22:42 ——– d—–w- c:\windows\system32\drivers\NAV
2010-12-06 22:42 . 2010-12-06 22:42 ——– d—–w- c:\program files\Norton AntiVirus
2010-12-06 22:41 . 2010-12-06 22:41 ——– d—–w- c:\program files\NortonInstaller
2010-12-06 21:58 . 2010-12-06 21:58 ——– d—–w- C:\NBRT
2010-12-06 21:27 . 2010-12-06 21:27 ——– d—–w- c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com
2010-12-06 21:27 . 2010-12-06 21:27 ——– d—–w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2010-12-06 21:26 . 2010-12-06 21:27 ——– d—–w- c:\program files\SUPERAntiSpyware
2010-12-06 21:04 . 2010-12-06 21:04 ——– d—–w- c:\program files\Trend Micro
2010-12-06 20:40 . 2008-04-14 12:00 15872 —-a-w- c:\windows\EXPAND.EXE
2010-12-06 20:35 . 2008-04-14 10:42 1033728 —-a-w- c:\windows\explorer.exe
2010-12-06 19:33 . 2010-12-06 19:33 ——– d—–w- c:\documents and settings\Owner\Application Data\Tific
2010-12-06 19:33 . 2010-12-06 19:33 ——– d—–w- c:\documents and settings\Owner\Local Settings\Application Data\Symantec
2010-12-06 16:38 . 2010-12-06 16:38 ——– d—–w- c:\program files\Common Files\Java
2010-12-06 16:37 . 2010-12-06 16:37 ——– d—–w- c:\program files\Carbonite
2010-12-06 16:31 . 2010-12-06 16:31 ——– d—–w- c:\program files\Windows Sidebar
2010-12-06 16:31 . 2010-12-06 22:42 ——– d—–w- c:\documents and settings\All Users\Application Data\Norton
2010-12-05 22:29 . 2010-12-05 22:29 ——– d—–w- c:\documents and settings\Owner\Application Data\Malwarebytes
2010-12-05 22:29 . 2010-11-29 22:42 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-12-05 22:28 . 2010-12-05 22:28 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-12-05 22:28 . 2010-12-05 22:29 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-12-05 22:28 . 2010-11-29 22:42 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-12-05 22:07 . 2010-12-09 02:17 ——– d—–w- C:\Anti Virus Cleanup tools
2010-12-01 18:05 . 2010-12-01 18:05 1409 —-a-w- c:\windows\QTFont.for

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-12-06 20:11 . 2005-03-23 16:53 507904 —-a-w- c:\windows\system32\winlogon.exe.bak
2010-09-18 16:23 . 2005-03-23 16:52 974848 —-a-w- c:\windows\system32\mfc42u.dll
2010-09-18 06:53 . 2005-03-23 16:52 974848 —-a-w- c:\windows\system32\mfc42.dll
2010-09-18 06:53 . 2005-03-23 16:52 954368 —-a-w- c:\windows\system32\mfc40.dll
2010-09-18 06:53 . 2005-03-23 16:52 953856 —-a-w- c:\windows\system32\mfc40u.dll
2010-09-15 09:50 . 2010-06-14 19:46 472808 —-a-w- c:\windows\system32\deployJava1.dll
2010-09-15 07:29 . 2009-10-06 02:42 73728 —-a-w- c:\windows\system32\javacpl.cpl
2010-09-10 05:58 . 2005-03-23 16:53 916480 —-a-w- c:\windows\system32\wininet.dll
2010-09-10 05:58 . 2005-03-23 16:52 43520 ——w- c:\windows\system32\licmgr10.dll
2010-09-10 05:58 . 2005-03-23 16:52 1469440 ——w- c:\windows\system32\inetcpl.cpl
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Weather"="c:\program files\AWS\WeatherBug\Weather.exe" [2009-12-29 1653248]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunKistEM"="c:\program files\Digital Media Reader\shwiconem.exe" [2004-11-15 135168]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-03-18 339968]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-03 32768]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-14 212992]
"SoundMan"="SOUNDMAN.EXE" [2004-12-01 77824]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-07-21 61440]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-10-06 98304]
"FaxTalk Messenger Pro 8"="c:\program files\FaxTalk\FTClCtrl.exe" [2010-05-20 120152]
"CarboniteSetupLite"="c:\program files\Carbonite\CarbonitePreinstaller.exe" [2010-11-21 283792]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{EDB0E980-90BD-11D4-8599-0008C7D3B6F8}"= "c:\program files\Qualcomm\Eudora\EuShlExt.dll" [2005-11-14 86016]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist Express Customer]
2010-11-06 07:20 147832 —-a-w- c:\program files\Citrix\GoToAssist Express Customer\258\g2ax_winlogon.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-02-27 21:10 35696 —-a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 09:42 1695232 —-a-w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 18:50 155648 —-a-w- c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-10-06 03:49 98304 —-a-w- c:\program files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NAV\1201000.025\SymDS.sys [12/6/2010 5:42 PM 339504]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NAV\1201000.025\SymEFA.sys [12/6/2010 5:42 PM 666672]
R1 BHDrvx86;BHDrvx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\BASHDefs\20101123.003\BHDrvx86.sys [11/22/2010 9:20 PM 691248]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 1:25 PM 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/10/2010 1:41 PM 67656]
R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NAV\1201000.025\Ironx86.sys [12/6/2010 5:42 PM 134704]
R2 FaxTalk Messenger Pro 8;FaxTalk Messenger Pro 8;c:\program files\FaxTalk\FTmsgsvc.exe [5/20/2010 12:01 PM 32600]
R2 GoToAssist Express Customer;GoToAssist Express Customer;c:\program files\Citrix\GoToAssist Express Customer\258\g2ax_service.exe [11/6/2010 2:20 AM 161144]
R2 NAV;Norton AntiVirus;c:\program files\Norton AntiVirus\Engine\18.1.0.37\ccSvcHst.exe [12/6/2010 5:42 PM 126904]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [12/8/2010 10:40 AM 102448]
R3 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\IPSDefs\20101208.001\IDSXpx86.sys [12/8/2010 12:19 AM 341944]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3/18/2010 1:16 PM 130384]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [3/18/2010 1:16 PM 753504]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WINRM REG_MULTI_SZ WINRM
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.usatoday.com/
uInternet Connection Wizard,ShellNext = "c:\program files\Outlook Express\msimn.exe"
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-12-08 21:26
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NAV]
"ImagePath"="\"c:\program files\Norton AntiVirus\Engine\18.1.0.37\ccSvcHst.exe\" /s \"NAV\" /m \"c:\program files\Norton AntiVirus\Engine\18.1.0.37\diMaster.dll\" /prefetch:1"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(728)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
c:\windows\system32\Ati2evxx.dll
c:\program files\Citrix\GoToAssist Express Customer\258\g2ax_winlogon.dll

- - - - - - - > 'explorer.exe'(2260)
c:\windows\system32\WININET.dll
c:\windows\system32\msi.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\IEFRAME.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2010-12-08 21:31:57
ComboFix-quarantined-files.txt 2010-12-09 02:31
ComboFix2.txt 2010-12-07 21:30

Pre-Run: 119,855,845,376 bytes free
Post-Run: 119,841,640,448 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

- - End Of File - - F007D78EC2C528EAA73E767E26DBF02A