ad.trafficmp

Having problems with just 1 specific web site WWW.Kia.Com and I am getting errors related to ad.trafficmp. I tried on other laptops and can access this site but not on my desktop. I use manynational car dealer sites for images for a web provider.
I use IE8 and have run full system scans, Registry cleanup, defrag and optimaztion. I also reset my modem and router.

Getting messages "Couldn't Find "http://ad.trafficmp.com/a/ct%3Fadv%3D758" and it also opened 2 additional tabs saying "Navigation Cancelled"

Thanks in advance
Jack



Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 2:07:05 PM, on 10/27/2012
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
C:\Program Files\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe
C:\WINDOWS\system32\lxdfcoms.exe
C:\Program Files\Norton Security Suite\Engine\6.4.0.9\ccSvcHst.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Norton Security Suite\Engine\6.4.0.9\ccSvcHst.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lexmark 6500 Series\lxdfamon.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Lexmark 6500 Series\lxdfmon.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Program Files\Kodak\MediaImpression\ArcMonitor.exe
C:\Program Files\Kodak\KODAK Share Button App\Listener.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac
C:\Program Files\FinePixViewerS\QuickDCF2.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\msiexec.exe
C:\Download\Hijack\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/a
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Security Suite\Engine\6.4.0.9\coIEPlg.dll
O2 - BHO: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Security Suite\Engine\6.4.0.9\IPS\IPSBHO.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: GoogleAFE - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\Program Files\GoogleAFE\GoogleAE.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Security Suite\Engine\6.4.0.9\coIEPlg.dll
O4 - HKLM\..\Run: [lxdfamon] "C:\Program Files\Lexmark 6500 Series\lxdfamon.exe"
O4 - HKLM\..\Run: [Lexmark 6500 Series Fax Server] "C:\Program Files\Lexmark 6500 Series\fm3032.exe" /s
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [lxdfmon.exe] "C:\Program Files\Lexmark 6500 Series\lxdfmon.exe"
O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKLM\..\Run: [ArcSoft MediaImpression Monitor] C:\Program Files\Kodak\MediaImpression\ArcMonitor.exe
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [KodakShareButtonApp] C:\Program Files\Kodak\KODAK Share Button App\Listener.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [KGShareApp] C:\Program Files\Kodak\KODAK Share Button App\KGShare_App.exe
O4 - Global Startup: Exif Launcher S.lnk = C:\Program Files\FinePixViewerS\QuickDCF2.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {0713E8D2-850A-101B-AFC0-4210102A8DA7} (Microsoft ProgressBar Control, version 5.0 (SP2)) - http://download.mcafee.com/molbin/Shared/C…22/ComCtl32.cab
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/MSDcode.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1…toUploader5.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - http://a516.g.akamai.net/f/516/25175/7d/ru…cat-no-eula.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m…01/mcinsctl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1142431585967
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1343740525593
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.0…oUploader55.cab
O16 - DPF: {84818113-96C5-11D2-BE39-006008BF4DD5} (ViewDirector Object) - http://www.scotlandspeople.gov.uk/Viewers/…ol/viewdw32.ocx
O16 - DPF: {9732FB42-C321-11D1-836F-00A0C993F125} (mhLabel Class) - http://www.pcpitstop.com/mhLbl.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/m…,26/mcgdmgr.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…133/mcfscan.cab
O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\480\G2AWinLogon.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist\480\g2aservice.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Intuit Update Service (IntuitUpdateService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
O23 - Service: Intuit Update Service v4 (IntuitUpdateServiceV4) - Intuit Inc. - C:\Program Files\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: lxdfCATSCustConnectService - Lexmark International, Inc. - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxdfserv.exe
O23 - Service: lxdf_device - - C:\WINDOWS\system32\lxdfcoms.exe
O23 - Service: Norton Security Suite (N360) - Symantec Corporation - C:\Program Files\Norton Security Suite\Engine\6.4.0.9\ccSvcHst.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: OpenVPN Service (OpenVPNService) - Unknown owner - C:\Download\OpenVPN\bin\openvpnserv.exe
O23 - Service: ptssvc - Unknown owner - C:\Program Files\KODAK\KODAK Picture Transfer Software\PTSsvc.exe (file missing)
O23 - Service: Symantec RemoteAssist - Symantec, Inc. - C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe

–
End of file - 10547 bytes

Hello and

My name is patndoris. I will be glad to take a look at your log and help you with solving any malware problems. It will be very helpful if you follow these guidelines:

• Malware logs are often lengthy and can take a lot of time to research and interpret. Please be patient while I review your logs.
• Please note that there is no "Quick Fix" to modern malware infections and we may need to use several different approaches to get your system clean.
• Please make sure to carefully read any instruction that I give you. If you're not sure, or if something unexpected happens, do NOT continue! Stop and ask!
• Please follow my instructions carefully and in the order they are posted. You may also find it helpful to print out the instructions you receive.
• Please do not run any scans or install/uninstall any applications or delete anything without being directed to do so.
• Remember, absence of symptoms does not mean the infection is all gone. Please stick with me till you're given the "all clear".
• Please do not use the Attachment feature for any log file. Do a Copy/Paste of the entire contents of the log file and submit it inside your post.
• Please reply within 3 days. If I do not hear back from you in that time frame, I will post a reminder for you. Topics with no reply in 4 days are closed!

HijackThis has largely been replaced by other tools. Since being acquired by TrendMicro, HijackThis has not been regularly updated. Many infections are now able to hide partly, or completely from a HijackThis scan. DDS includes all the scan locations of HijackThis and more.


Download and Run DDS by sUBs

We need to see some information about what is happening in your machine. Please perform the following scan:

• Download DDS by sUBs from one of the following links. Save it to your desktop.
  • DDS.com
  • DDS.pif
• Double click on the DDS icon, allow it to run.
• A small box will open, with an explaination about the tool. No input is needed, the scan is running.
• Notepad will open with the results.
• Follow the instructions that pop up for posting the results.
• Close the program window, and delete the program from your desktop.

Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE



Please read carefully and follow these steps. There is a difference between what you see in one of the images below and what I need you to do.
We are only creating a log - I do NOT want you to "cure" or try to fix anything in this step. It is very important that you don't choose Cure when presented with that option.

• Download TDSSKiller and save it to your Desktop.
• Extract its contents to your desktop.
• Once extracted, open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
  
  
  🖼Click to load external image (Posted Image)
  
  
• If an infected file is detected, the default action will be Cure but I want you to choose SKIP instead , click on Continue.
  
  
  🖼Click to load external image (Posted Image)
  
  
• If a suspicious file is detected, the default action will be Skip, click on Continue.
  
  
  🖼Click to load external image (Posted Image)
  
  
• It may ask you to reboot the computer to complete the process. Click on Reboot Now.
  
  
  🖼Click to load external image (Posted Image)
  
  
• If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
• If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.

DDS Log DDS (Ver_2012-10-19.01) - NTFS_x86 Internet Explorer: 8.0.6001.18702 Run by [removed] at 8:25:03 on 2012-10-28 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3070.2506 [GMT -4:00] . AV: Norton Security Suite *Enabled/Updated* {E10A9785-9598-4754-B552-92431C1C35F8} FW: Norton Security Suite *Enabled* . ============== Running Processes ================ . C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe C:\Program Files\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe C:\WINDOWS\system32\lxdfcoms.exe C:\Program Files\Norton Security Suite\Engine\6.4.0.9\ccSvcHst.exe C:\WINDOWS\ehome\mcrdsvc.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Norton Security Suite\Engine\6.4.0.9\ccSvcHst.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Lexmark 6500 Series\lxdfamon.exe C:\Program Files\Microsoft IntelliPoint\point32.exe C:\Program Files\Lexmark 6500 Series\lxdfmon.exe C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe C:\Program Files\Kodak\MediaImpression\ArcMonitor.exe C:\Program Files\Kodak\KODAK Share Button App\Listener.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac C:\Program Files\FinePixViewerS\QuickDCF2.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k NetworkService C:\WINDOWS\system32\svchost.exe -k LocalService C:\WINDOWS\system32\svchost.exe -k LocalService C:\WINDOWS\system32\svchost.exe -k LocalService C:\WINDOWS\system32\svchost.exe -k imgsvc . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.comcast.net/a uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 BHO: Adobe PDF Reader Link Helper: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll BHO: Norton Identity Protection: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - c:\program files\norton security suite\engine\6.4.0.9\coieplg.dll BHO: Norton Vulnerability Protection: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - c:\program files\norton security suite\engine\6.4.0.9\ips\ipsbho.dll BHO: SSVHelper Class: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre1.6.0_02\bin\ssv.dll BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll BHO: CBrowserHelperObject Object: {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\program files\googleafe\GoogleAE.dll TB: &Google: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - c:\program files\norton security suite\engine\6.4.0.9\coieplg.dll EB: Real.com: {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\shdocvw.dll uRun: [updateMgr] "c:\program files\adobe\acrobat 7.0\reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1 uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [KGShareApp] c:\program files\kodak\kodak share button app\KGShare_App.exe mRun: [lxdfamon] "c:\program files\lexmark 6500 series\lxdfamon.exe" mRun: [Lexmark 6500 Series Fax Server] "c:\program files\lexmark 6500 series\fm3032.exe" /s mRun: [IntelliPoint] "c:\program files\microsoft intellipoint\point32.exe" mRun: [lxdfmon.exe] "c:\program files\lexmark 6500 series\lxdfmon.exe" mRun: [ArcSoft Connection Service] c:\program files\common files\arcsoft\connection service\bin\ACDaemon.exe mRun: [ArcSoft MediaImpression Monitor] c:\program files\kodak\mediaimpression\ArcMonitor.exe mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe" mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [KodakShareButtonApp] c:\program files\kodak\kodak share button app\Listener.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\exifla~1.lnk - c:\program files\finepixviewers\QuickDCF2.exe uPolicies-Explorer: NoDrives = dword:0 uPolicies-Explorer: NoDriveTypeAutoRun = dword:145 mPolicies-Explorer: NoDriveAutoRun = dword:67108863 mPolicies-Explorer: NoDriveTypeAutoRun = dword:323 mPolicies-Explorer: NoDrives = dword:0 mPolicies-Windows\System: Allow-LogonScript-NetbiosDisabled = dword:1 mPolicies-Explorer: NoDriveTypeAutoRun = dword:145 mPolicies-Explorer: NoDriveAutoRun = dword:67108863 IE: &Google Search - c:\program files\google\GoogleToolbar2.dll/cmsearch.html IE: &Translate English Word - c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html IE: Backward Links - c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html IE: Cached Snapshot of Page - c:\program files\google\GoogleToolbar2.dll/cmcache.html IE: Similar Pages - c:\program files\google\GoogleToolbar2.dll/cmsimilar.html IE: Translate Page into English - c:\program files\google\GoogleToolbar2.dll/cmtrans.html IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_02\bin\ssv.dll IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe Trusted Zone: turbotax.com DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} - hxxp://support.dell.com/systemprofiler/SysPro.CAB DPF: {0713E8D2-850A-101B-AFC0-4210102A8DA7} - hxxp://download.mcafee.com/molbin/Shared/ComCtl32/6,0,80,22/ComCtl32.cab DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} - hxxps://support.microsoft.com/OAS/ActiveX/MSDcode.cab DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} - hxxp://www.pcpitstop.com/pcpitstop/PCPitStop.CAB DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} - hxxp://a516.g.akamai.net/f/516/25175/7d/runaware.download.akamai.com/25175/citrix/wficat-no-eula.cab DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - hxxp://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1142431585967 DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1343740525593 DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab DPF: {84818113-96C5-11D2-BE39-006008BF4DD5} - hxxp://www.scotlandspeople.gov.uk/Viewers/ActiveXControl/viewdw32.ocx DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab DPF: {9732FB42-C321-11D1-836F-00A0C993F125} - hxxp://www.pcpitstop.com/mhLbl.cab DPF: {A4639D2F-774E-11D3-A490-00C04F6843FB} - hxxp://download.microsoft.com/download/PowerPoint2002/Install/10.0.2609/WIN98MeXP/EN-US/msorun.cab DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - hxxp://download.mcafee.com/molbin/shared/mcgdmgr/1,0,0,26/mcgdmgr.cab DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_09-windows-i586.cab DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} - hxxp://download.mcafee.com/molbin/iss-loc/mcfscan/2,2,0,5133/mcfscan.cab TCP: NameServer = 75.75.75.75 75.75.76.76 TCP: Interfaces\{0DDF1F71-1147-41EA-90C0-6EECF748FF69} : DHCPNameServer = 75.75.75.75 75.75.76.76 TCP: Interfaces\{AD586788-69A5-43CD-B0D5-71AB439B0E4A} : DHCPNameServer = [removed] [removed] Notify: GoToAssist - c:\program files\citrix\gotoassist\480\G2AWinLogon.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll . ============= SERVICES / DRIVERS =============== . R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\n360\0604000.009\symds.sys [2012-10-9 340088] R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\n360\0604000.009\symefa.sys [2012-10-9 924320] R1 BHDrvx86;BHDrvx86;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_6.0.0.145\definitions\bashdefs\20121005.002\BHDrvx86.sys [2012-10-5 995488] R1 ccSet_N360;Norton Security Suite Settings Manager;c:\windows\system32\drivers\n360\0604000.009\ccsetx86.sys [2012-10-9 132768] R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\n360\0604000.009\ironx86.sys [2012-10-9 149624] R2 IntuitUpdateServiceV4;Intuit Update Service v4;c:\program files\common files\intuit\update service v4\IntuitUpdateService.exe [2011-8-25 13672] R2 lxdf_device;lxdf_device;c:\windows\system32\lxdfcoms.exe -service –> c:\windows\system32\lxdfcoms.exe -service [?] R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328] R2 N360;Norton Security Suite;c:\program files\norton security suite\engine\6.4.0.9\ccsvchst.exe [2012-10-9 138272] R3 ArcCD;ArcCD Filter Driver Service;c:\windows\system32\drivers\ArcCD.sys [2010-12-26 36224] R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2012-8-9 106656] R3 IDSxpx86;IDSxpx86;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_6.0.0.145\definitions\ipsdefs\20121027.001\IDSXpx86.sys [2012-10-27 373728] R3 NAVENG;NAVENG;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_6.0.0.145\definitions\virusdefs\20121027.007\NAVENG.SYS [2012-10-27 92704] R3 NAVEX15;NAVEX15;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_6.0.0.145\definitions\virusdefs\20121027.007\NAVEX15.SYS [2012-10-27 1601184] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2009-8-20 133104] S2 lxdfCATSCustConnectService;lxdfCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxdfserv.exe [2008-3-13 99248] S2 ptssvc;ptssvc;c:\program files\kodak\kodak picture transfer software\ptssvc.exe –> c:\program files\kodak\kodak picture transfer software\PTSsvc.exe [?] S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-4-4 250808] S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2009-8-20 133104] S3 MatSvc;Microsoft Automated Troubleshooting Service;c:\program files\microsoft fix it center\Matsvc.exe [2011-6-13 267568] S3 tap0801;TAP-Win32 Adapter V8;c:\windows\system32\drivers\tap0801.sys [2006-4-6 23552] S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504] S4 ArcUdfs;ArcUdfs FileSystem Driver Service;c:\windows\system32\drivers\ArcUdfs.sys [2010-12-26 134912] . =============== Created Last 30 ================ . 2012-10-27 18:04:39 388096 —-a-r- c:\documents and settings\john conway\application data\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe 2012-10-20 12:31:01 8183743 —-a-w- c:\documents and settings\all users\SPL1F.tmp 2012-10-12 20:07:22 ——– d—–w- c:\windows\_ISTMP2.DIR 2012-10-09 19:04:01 388216 —-a-r- c:\windows\system32\drivers\n360\0604000.009\symtdi.sys 2012-10-09 19:04:01 345208 —-a-r- c:\windows\system32\drivers\n360\0604000.009\symtdiv.sys 2012-10-09 19:04:01 318584 —-a-r- c:\windows\system32\drivers\n360\0604000.009\symnets.sys 2012-10-09 19:04:00 924320 —-a-w- c:\windows\system32\drivers\n360\0604000.009\symefa.sys 2012-10-09 19:04:00 574112 —-a-w- c:\windows\system32\drivers\n360\0604000.009\srtsp.sys 2012-10-09 19:04:00 340088 —-a-r- c:\windows\system32\drivers\n360\0604000.009\symds.sys 2012-10-09 19:04:00 32928 —-a-w- c:\windows\system32\drivers\n360\0604000.009\srtspx.sys 2012-10-09 19:04:00 149624 —-a-r- c:\windows\system32\drivers\n360\0604000.009\ironx86.sys 2012-10-09 19:04:00 132768 —-a-w- c:\windows\system32\drivers\n360\0604000.009\ccsetx86.sys 2012-10-09 19:03:17 8942 —-a-w- c:\windows\system32\drivers\n360\0604000.009\symvtcer.dat 2012-10-09 19:03:17 ——– d—–w- c:\windows\system32\drivers\n360\0604000.009 . ==================== Find3M ==================== . 2012-10-27 19:10:27 73656 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2012-10-27 19:10:27 696760 —-a-w- c:\windows\system32\FlashPlayerApp.exe 2012-08-28 15:14:53 916992 —-a-w- c:\windows\system32\wininet.dll 2012-08-28 15:14:53 43520 ——w- c:\windows\system32\licmgr10.dll 2012-08-28 15:14:52 1469440 ——w- c:\windows\system32\inetcpl.cpl 2012-08-28 12:07:15 385024 ——w- c:\windows\system32\html.iec 2012-08-24 13:53:22 177664 —-a-w- c:\windows\system32\wintrust.dll 2012-08-21 13:33:26 2148864 —-a-w- c:\windows\system32\ntoskrnl.exe 2012-08-21 12:58:09 2027520 —-a-w- c:\windows\system32\ntkrnlpa.exe . ============= FINISH: 8:26:12.85 =============== TDS Killer found nothing log follows 08:49:46.0562 2456 TDSS rootkit removing tool [removed] Oct 12 2012 17:26:47 08:49:47.0281 2456 ============================================================ 08:49:47.0281 2456 Current date / time: 2012/10/28 08:49:47.0281 08:49:47.0281 2456 SystemInfo: 08:49:47.0281 2456 08:49:47.0281 2456 OS Version: 5.1.2600 ServicePack: 3.0 08:49:47.0281 2456 Product type: Workstation 08:49:47.0281 2456 ComputerName: D62GJM91 08:49:47.0281 2456 UserName: John Conway 08:49:47.0281 2456 Windows directory: C:\WINDOWS 08:49:47.0281 2456 System windows directory: C:\WINDOWS 08:49:47.0281 2456 Processor architecture: Intel x86 08:49:47.0281 2456 Number of processors: 2 08:49:47.0281 2456 Page size: 0x1000 08:49:47.0281 2456 Boot type: Normal boot 08:49:47.0281 2456 ============================================================ 08:49:48.0406 2456 Drive \Device\Harddisk0\DR0 - Size: 0x2540BE4000 (149.01 Gb), SectorSize: 0x200, Cylinders: 0x4BFC, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054 08:49:48.0421 2456 ============================================================ 08:49:48.0421 2456 \Device\Harddisk0\DR0: 08:49:48.0421 2456 MBR partitions: 08:49:48.0421 2456 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x1B747, BlocksNum 0x1209CE16 08:49:48.0421 2456 ============================================================ 08:49:48.0468 2456 C: <-> \Device\Harddisk0\DR0\Partition1 08:49:48.0468 2456 ============================================================ 08:49:48.0468 2456 Initialize success 08:49:48.0468 2456 ============================================================ 08:50:23.0078 0304 ============================================================ 08:50:23.0078 0304 Scan started 08:50:23.0078 0304 Mode: Manual; 08:50:23.0078 0304 ============================================================ 08:50:23.0281 0304 ================ Scan system memory ======================== 08:50:23.0281 0304 Scan interrupted by user! 08:50:23.0281 0304 ================ Scan services ============================= 08:50:23.0281 0304 Scan interrupted by user! 08:50:23.0281 0304 ================ Scan global =============================== 08:50:23.0281 0304 Scan interrupted by user! 08:50:23.0281 0304 ================ Scan MBR ================================== 08:50:23.0281 0304 Scan interrupted by user! 08:50:23.0281 0304 ================ Scan VBR ================================== 08:50:23.0281 0304 Scan interrupted by user! 08:50:23.0281 0304 ============================================================ 08:50:23.0281 0304 Scan finished 08:50:23.0281 0304 ============================================================ 08:50:23.0296 2972 Detected object count: 0 08:50:23.0296 2972 Actual detected object count: 0 08:50:26.0921 0968 ============================================================ 08:50:26.0921 0968 Scan started 08:50:26.0921 0968 Mode: Manual; 08:50:26.0921 0968 ============================================================ 08:50:27.0046 0968 ================ Scan system memory ======================== 08:50:27.0062 0968 System memory - ok 08:50:27.0062 0968 ================ Scan services ============================= 08:50:27.0140 0968 Abiosdsk - ok 08:50:27.0171 0968 [ 6ABB91494FE6C59089B9336452AB2EA3 ] abp480n5 C:\WINDOWS\system32\DRIVERS\ABP480N5.SYS 08:50:27.0171 0968 abp480n5 - ok 08:50:27.0296 0968 [ ADC420616C501B45D26C0FD3EF1E54E4 ] ACDaemon C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe 08:50:27.0296 0968 ACDaemon - ok 08:50:27.0343 0968 [ 8FD99680A539792A30E97944FDAECF17 ] ACPI C:\WINDOWS\system32\DRIVERS\ACPI.sys 08:50:27.0343 0968 ACPI - ok 08:50:27.0375 0968 [ 9859C0F6936E723E4892D7141B1327D5 ] ACPIEC C:\WINDOWS\system32\drivers\ACPIEC.sys 08:50:27.0375 0968 ACPIEC - ok 08:50:27.0437 0968 [ 44C00A385CA9DBC1D5CF3781F8C26AEA ] AdobeFlashPlayerUpdateSvc C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe 08:50:27.0437 0968 AdobeFlashPlayerUpdateSvc - ok 08:50:27.0453 0968 [ 9A11864873DA202C996558B2106B0BBC ] adpu160m C:\WINDOWS\system32\DRIVERS\adpu160m.sys 08:50:27.0453 0968 adpu160m - ok 08:50:27.0484 0968 [ 8BED39E3C35D6A489438B8141717A557 ] aec C:\WINDOWS\system32\drivers\aec.sys 08:50:27.0484 0968 aec - ok 08:50:27.0531 0968 [ FE3EA6E9AFC1A78E6EDCA121E006AFB7 ] Afc C:\WINDOWS\system32\drivers\Afc.sys 08:50:27.0531 0968 Afc - ok 08:50:27.0578 0968 [ 1E44BC1E83D8FD2305F8D452DB109CF9 ] AFD C:\WINDOWS\System32\drivers\afd.sys 08:50:27.0578 0968 AFD - ok 08:50:27.0609 0968 [ 08FD04AA961BDC77FB983F328334E3D7 ] agp440 C:\WINDOWS\system32\DRIVERS\agp440.sys 08:50:27.0609 0968 agp440 - ok 08:50:27.0625 0968 [ 03A7E0922ACFE1B07D5DB2EEB0773063 ] agpCPQ C:\WINDOWS\system32\DRIVERS\agpCPQ.sys 08:50:27.0625 0968 agpCPQ - ok 08:50:27.0625 0968 [ C23EA9B5F46C7F7910DB3EAB648FF013 ] Aha154x C:\WINDOWS\system32\DRIVERS\aha154x.sys 08:50:27.0625 0968 Aha154x - ok 08:50:27.0656 0968 [ 19DD0FB48B0C18892F70E2E7D61A1529 ] aic78u2 C:\WINDOWS\system32\DRIVERS\aic78u2.sys 08:50:27.0656 0968 aic78u2 - ok 08:50:27.0671 0968 [ B7FE594A7468AA0132DEB03FB8E34326 ] aic78xx C:\WINDOWS\system32\DRIVERS\aic78xx.sys 08:50:27.0671 0968 aic78xx - ok 08:50:27.0703 0968 [ A9A3DAA780CA6C9671A19D52456705B4 ] Alerter C:\WINDOWS\system32\alrsvc.dll 08:50:27.0703 0968 Alerter - ok 08:50:27.0734 0968 [ 8C515081584A38AA007909CD02020B3D ] ALG C:\WINDOWS\System32\alg.exe 08:50:27.0734 0968 ALG - ok 08:50:27.0765 0968 [ 1140AB9938809700B46BB88E46D72A96 ] AliIde C:\WINDOWS\system32\DRIVERS\aliide.sys 08:50:27.0765 0968 AliIde - ok 08:50:27.0781 0968 [ CB08AED0DE2DD889A8A820CD8082D83C ] alim1541 C:\WINDOWS\system32\DRIVERS\alim1541.sys 08:50:27.0781 0968 alim1541 - ok 08:50:27.0796 0968 [ 95B4FB835E28AA1336CEEB07FD5B9398 ] amdagp C:\WINDOWS\system32\DRIVERS\amdagp.sys 08:50:27.0796 0968 amdagp - ok 08:50:27.0812 0968 [ 79F5ADD8D24BD6893F2903A3E2F3FAD6 ] amsint C:\WINDOWS\system32\DRIVERS\amsint.sys 08:50:27.0812 0968 amsint - ok 08:50:27.0843 0968 [ D8849F77C0B66226335A59D26CB4EDC6 ] AppMgmt C:\WINDOWS\System32\appmgmts.dll 08:50:27.0843 0968 AppMgmt - ok 08:50:27.0875 0968 [ A82F1A1B09593C73EFD02A59DC94920C ] ArcCD C:\WINDOWS\system32\drivers\ArcCD.sys 08:50:27.0875 0968 ArcCD - ok 08:50:27.0890 0968 [ 1AF9061B61741A912368AB4DC309D25E ] ArcRec C:\WINDOWS\system32\drivers\ArcRec.sys 08:50:27.0890 0968 ArcRec - ok 08:50:27.0921 0968 [ 3EE9E41102A2C6B8F7DBAD5D44ABDA05 ] ArcUdfs C:\WINDOWS\system32\drivers\ArcUdfs.sys 08:50:27.0937 0968 ArcUdfs - ok 08:50:27.0937 0968 [ 62D318E9A0C8FC9B780008E724283707 ] asc C:\WINDOWS\system32\DRIVERS\asc.sys 08:50:27.0937 0968 asc - ok 08:50:27.0953 0968 [ 69EB0CC7714B32896CCBFD5EDCBEA447 ] asc3350p C:\WINDOWS\system32\DRIVERS\asc3350p.sys 08:50:27.0953 0968 asc3350p - ok 08:50:27.0968 0968 [ 5D8DE112AA0254B907861E9E9C31D597 ] asc3550 C:\WINDOWS\system32\DRIVERS\asc3550.sys 08:50:27.0968 0968 asc3550 - ok 08:50:28.0062 0968 [ 0E5E4957549056E2BF2C49F4F6B601AD ] aspnet_state C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe 08:50:28.0062 0968 aspnet_state - ok 08:50:28.0093 0968 [ B153AFFAC761E7F5FCFA822B9C4E97BC ] AsyncMac C:\WINDOWS\system32\DRIVERS\asyncmac.sys 08:50:28.0093 0968 AsyncMac - ok 08:50:28.0125 0968 [ 9F3A2F5AA6875C72BF062C712CFA2674 ] atapi C:\WINDOWS\system32\DRIVERS\atapi.sys 08:50:28.0125 0968 atapi - ok 08:50:28.0125 0968 Atdisk - ok 08:50:28.0156 0968 [ ABC57A6F6070BAF9786C318F59F29F0B ] Ati HotKey Poller C:\WINDOWS\system32\Ati2evxx.exe 08:50:28.0156 0968 Ati HotKey Poller - ok 08:50:28.0234 0968 [ 03621F7F968FF63713943405DEB777F9 ] ati2mtag C:\WINDOWS\system32\DRIVERS\ati2mtag.sys 08:50:28.0250 0968 ati2mtag - ok 08:50:28.0265 0968 [ 9916C1225104BA14794209CFA8012159 ] Atmarpc C:\WINDOWS\system32\DRIVERS\atmarpc.sys 08:50:28.0265 0968 Atmarpc - ok 08:50:28.0312 0968 [ DEF7A7882BEC100FE0B2CE2549188F9D ] AudioSrv C:\WINDOWS\System32\audiosrv.dll 08:50:28.0312 0968 AudioSrv - ok 08:50:28.0359 0968 [ D9F724AA26C010A217C97606B160ED68 ] audstub C:\WINDOWS\system32\DRIVERS\audstub.sys 08:50:28.0359 0968 audstub - ok 08:50:28.0406 0968 [ DA1F27D85E0D1525F6621372E7B685E9 ] Beep C:\WINDOWS\system32\drivers\Beep.sys 08:50:28.0406 0968 Beep - ok 08:50:28.0687 0968 [ 684B12018A54ADC1F856372EC5762B48 ] BHDrvx86 C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\Definitions\BASHDefs\20121005.002\BHDrvx86.sys 08:50:28.0703 0968 BHDrvx86 - ok 08:50:28.0765 0968 [ 574738F61FCA2935F5265DC4E5691314 ] BITS C:\WINDOWS\system32\qmgr.dll 08:50:28.0765 0968 BITS - ok 08:50:28.0812 0968 [ CFD4E51402DA9838B5A04AE680AF54A0 ] Browser C:\WINDOWS\System32\browser.dll 08:50:28.0812 0968 Browser - ok 08:50:28.0812 0968 bvrp_pci - ok 08:50:28.0843 0968 [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf C:\WINDOWS\system32\DRIVERS\cbidf2k.sys 08:50:28.0843 0968 cbidf - ok 08:50:28.0859 0968 [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf2k C:\WINDOWS\system32\drivers\cbidf2k.sys 08:50:28.0859 0968 cbidf2k - ok 08:50:28.0953 0968 [ ACE85AF1C31F68BDFEE9333F6592917E ] ccSet_N360 C:\WINDOWS\system32\drivers\N360\0604000.009\ccSetx86.sys 08:50:28.0953 0968 ccSet_N360 - ok 08:50:28.0984 0968 [ F3EC03299634490E97BBCE94CD2954C7 ] cd20xrnt C:\WINDOWS\system32\DRIVERS\cd20xrnt.sys 08:50:28.0984 0968 cd20xrnt - ok 08:50:29.0015 0968 [ C1B486A7658353D33A10CC15211A873B ] Cdaudio C:\WINDOWS\system32\drivers\Cdaudio.sys 08:50:29.0015 0968 Cdaudio - ok 08:50:29.0046 0968 [ C885B02847F5D2FD45A24E219ED93B32 ] Cdfs C:\WINDOWS\system32\drivers\Cdfs.sys 08:50:29.0046 0968 Cdfs - ok 08:50:29.0062 0968 [ 1F4260CC5B42272D71F79E570A27A4FE ] Cdrom C:\WINDOWS\system32\DRIVERS\cdrom.sys 08:50:29.0062 0968 Cdrom - ok 08:50:29.0078 0968 Changer - ok 08:50:29.0109 0968 [ 1CFE720EB8D93A7158A4EBC3AB178BDE ] CiSvc C:\WINDOWS\system32\cisvc.exe 08:50:29.0109 0968 CiSvc - ok 08:50:29.0125 0968 [ 34CBE729F38138217F9C80212A2A0C82 ] ClipSrv C:\WINDOWS\system32\clipsrv.exe 08:50:29.0125 0968 ClipSrv - ok 08:50:29.0171 0968 [ D87ACAED61E417BBA546CED5E7E36D9C ] clr_optimization_v2.0.50727_32 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 08:50:29.0171 0968 clr_optimization_v2.0.50727_32 - ok 08:50:29.0250 0968 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe 08:50:29.0250 0968 clr_optimization_v4.0.30319_32 - ok 08:50:29.0281 0968 [ E5DCB56C533014ECBC556A8357C929D5 ] CmdIde C:\WINDOWS\system32\DRIVERS\cmdide.sys 08:50:29.0281 0968 CmdIde - ok 08:50:29.0281 0968 COMSysApp - ok 08:50:29.0312 0968 [ 3EE529119EED34CD212A215E8C40D4B6 ] Cpqarray C:\WINDOWS\system32\DRIVERS\cpqarray.sys 08:50:29.0312 0968 Cpqarray - ok 08:50:29.0328 0968 [ 3D4E199942E29207970E04315D02AD3B ] CryptSvc C:\WINDOWS\System32\cryptsvc.dll 08:50:29.0328 0968 CryptSvc - ok 08:50:29.0359 0968 [ E550E7418984B65A78299D248F0A7F36 ] dac2w2k C:\WINDOWS\system32\DRIVERS\dac2w2k.sys 08:50:29.0359 0968 dac2w2k - ok 08:50:29.0375 0968 [ 683789CAA3864EB46125AE86FF677D34 ] dac960nt C:\WINDOWS\system32\DRIVERS\dac960nt.sys 08:50:29.0375 0968 dac960nt - ok 08:50:29.0421 0968 [ 6B27A5C03DFB94B4245739065431322C ] DcomLaunch C:\WINDOWS\system32\rpcss.dll 08:50:29.0421 0968 DcomLaunch - ok 08:50:29.0468 0968 [ 5E38D7684A49CACFB752B046357E0589 ] Dhcp C:\WINDOWS\System32\dhcpcsvc.dll 08:50:29.0468 0968 Dhcp - ok 08:50:29.0500 0968 [ 044452051F3E02E7963599FC8F4F3E25 ] Disk C:\WINDOWS\system32\DRIVERS\disk.sys 08:50:29.0500 0968 Disk - ok 08:50:29.0515 0968 dmadmin - ok 08:50:29.0562 0968 [ D992FE1274BDE0F84AD826ACAE022A41 ] dmboot C:\WINDOWS\system32\drivers\dmboot.sys 08:50:29.0562 0968 dmboot - ok 08:50:29.0562 0968 [ 7C824CF7BBDE77D95C08005717A95F6F ] dmio C:\WINDOWS\system32\drivers\dmio.sys 08:50:29.0578 0968 dmio - ok 08:50:29.0578 0968 [ E9317282A63CA4D188C0DF5E09C6AC5F ] dmload C:\WINDOWS\system32\drivers\dmload.sys 08:50:29.0578 0968 dmload - ok 08:50:29.0625 0968 [ 57EDEC2E5F59F0335E92F35184BC8631 ] dmserver C:\WINDOWS\System32\dmserver.dll 08:50:29.0625 0968 dmserver - ok 08:50:29.0640 0968 [ 8A208DFCF89792A484E76C40E5F50B45 ] DMusic C:\WINDOWS\system32\drivers\DMusic.sys 08:50:29.0640 0968 DMusic - ok 08:50:29.0671 0968 [ 5F7E24FA9EAB896051FFB87F840730D2 ] Dnscache C:\WINDOWS\System32\dnsrslvr.dll 08:50:29.0671 0968 Dnscache - ok 08:50:29.0718 0968 [ 0F0F6E687E5E15579EF4DA8DD6945814 ] Dot3svc C:\WINDOWS\System32\dot3svc.dll 08:50:29.0718 0968 Dot3svc - ok 08:50:29.0734 0968 [ 40F3B93B4E5B0126F2F5C0A7A5E22660 ] dpti2o C:\WINDOWS\system32\DRIVERS\dpti2o.sys 08:50:29.0734 0968 dpti2o - ok 08:50:29.0750 0968 [ 8F5FCFF8E8848AFAC920905FBD9D33C8 ] drmkaud C:\WINDOWS\system32\drivers\drmkaud.sys 08:50:29.0750 0968 drmkaud - ok 08:50:29.0781 0968 [ 95974E66D3DE4951D29E28E8BC0B644C ] E100B C:\WINDOWS\system32\DRIVERS\e100b325.sys 08:50:29.0781 0968 E100B - ok 08:50:29.0812 0968 [ 2187855A7703ADEF0CEF9EE4285182CC ] EapHost C:\WINDOWS\System32\eapsvc.dll 08:50:29.0812 0968 EapHost - ok 08:50:29.0890 0968 [ 85B8B4032A895A746D46A288A9B30DED ] eeCtrl C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys 08:50:29.0890 0968 eeCtrl - ok 08:50:29.0968 0968 [ 5D1347AA5AE6E2F77D7F4F8372D95AC9 ] ehRecvr C:\WINDOWS\eHome\ehRecvr.exe 08:50:29.0968 0968 ehRecvr - ok 08:50:30.0015 0968 [ A53243709439AC2A4C216B817F8D7411 ] ehSched C:\WINDOWS\eHome\ehSched.exe 08:50:30.0015 0968 ehSched - ok 08:50:30.0046 0968 [ F9472131367D39435D750F5FA3D23582 ] Eplpdx02 C:\WINDOWS\system32\Drivers\EPLPDX02.SYS 08:50:30.0046 0968 Eplpdx02 - ok 08:50:30.0093 0968 [ B5A8A04A6E5B4E86B95B1553AA918F5F ] EraserUtilRebootDrv C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys 08:50:30.0093 0968 EraserUtilRebootDrv - ok 08:50:30.0125 0968 [ BC93B4A066477954555966D77FEC9ECB ] ERSvc C:\WINDOWS\System32\ersvc.dll 08:50:30.0125 0968 ERSvc - ok 08:50:30.0171 0968 [ 65DF52F5B8B6E9BBD183505225C37315 ] Eventlog C:\WINDOWS\system32\services.exe 08:50:30.0171 0968 Eventlog - ok 08:50:30.0218 0968 [ D4991D98F2DB73C60D042F1AEF79EFAE ] EventSystem C:\WINDOWS\system32\Es.dll 08:50:30.0218 0968 EventSystem - ok 08:50:30.0250 0968 [ 38D332A6D56AF32635675F132548343E ] Fastfat C:\WINDOWS\system32\drivers\Fastfat.sys 08:50:30.0250 0968 Fastfat - ok 08:50:30.0296 0968 [ 99BC0B50F511924348BE19C7C7313BBF ] FastUserSwitchingCompatibility C:\WINDOWS\System32\shsvcs.dll 08:50:30.0312 0968 FastUserSwitchingCompatibility - ok 08:50:30.0343 0968 [ E97D6A8684466DF94FF3BC24FB787A07 ] Fax C:\WINDOWS\system32\fxssvc.exe 08:50:30.0343 0968 Fax - ok 08:50:30.0375 0968 [ 92CDD60B6730B9F50F6A1A0C1F8CDC81 ] Fdc C:\WINDOWS\system32\DRIVERS\fdc.sys 08:50:30.0375 0968 Fdc - ok 08:50:30.0406 0968 [ D45926117EB9FA946A6AF572FBE1CAA3 ] Fips C:\WINDOWS\system32\drivers\Fips.sys 08:50:30.0406 0968 Fips - ok 08:50:30.0421 0968 [ 9D27E7B80BFCDF1CDD9B555862D5E7F0 ] Flpydisk C:\WINDOWS\system32\DRIVERS\flpydisk.sys 08:50:30.0421 0968 Flpydisk - ok 08:50:30.0468 0968 [ B2CF4B0786F8212CB92ED2B50C6DB6B0 ] FltMgr C:\WINDOWS\system32\drivers\fltmgr.sys 08:50:30.0468 0968 FltMgr - ok 08:50:30.0515 0968 [ 8BA7C024070F2B7FDD98ED8A4BA41789 ] FontCache3.0.0.0 c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe 08:50:30.0515 0968 FontCache3.0.0.0 - ok 08:50:30.0546 0968 [ 3E1E2BD4F39B0E2B7DC4F4D2BCC2779A ] Fs_Rec C:\WINDOWS\system32\drivers\Fs_Rec.sys 08:50:30.0546 0968 Fs_Rec - ok 08:50:30.0578 0968 [ 6AC26732762483366C3969C9E4D2259D ] Ftdisk C:\WINDOWS\system32\DRIVERS\ftdisk.sys 08:50:30.0578 0968 Ftdisk - ok 08:50:30.0609 0968 [ 25430FD938E631F028933069C266AD1D ] FVNETusb C:\WINDOWS\system32\DRIVERS\vnet558x.sys 08:50:30.0609 0968 FVNETusb - ok 08:50:30.0640 0968 [ 5AE3A887ECE5BBB72CFAB273C2FD1CFA ] GEARAspiWDM C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys 08:50:30.0640 0968 GEARAspiWDM - ok 08:50:30.0687 0968 [ 9D28B83E5830C143C37D6678C7409304 ] GoToAssist C:\Program Files\Citrix\GoToAssist\480\g2aservice.exe 08:50:30.0687 0968 GoToAssist - ok 08:50:30.0718 0968 [ 0A02C63C8B144BD8C86B103DEE7C86A2 ] Gpc C:\WINDOWS\system32\DRIVERS\msgpc.sys 08:50:30.0718 0968 Gpc - ok 08:50:30.0812 0968 [ 626A24ED1228580B9518C01930936DF9 ] gupdate C:\Program Files\Google\Update\GoogleUpdate.exe 08:50:30.0812 0968 gupdate - ok 08:50:30.0812 0968 [ 626A24ED1228580B9518C01930936DF9 ] gupdatem C:\Program Files\Google\Update\GoogleUpdate.exe 08:50:30.0812 0968 gupdatem - ok 08:50:30.0859 0968 [ 573C7D0A32852B48F3058CFD8026F511 ] HDAudBus C:\WINDOWS\system32\DRIVERS\HDAudBus.sys 08:50:30.0859 0968 HDAudBus - ok 08:50:30.0921 0968 [ 4FCCA060DFE0C51A09DD5C3843888BCD ] helpsvc C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll 08:50:30.0921 0968 helpsvc - ok 08:50:30.0953 0968 [ DEB04DA35CC871B6D309B77E1443C796 ] HidServ C:\WINDOWS\System32\hidserv.dll 08:50:30.0953 0968 HidServ - ok 08:50:30.0968 0968 [ CCF82C5EC8A7326C3066DE870C06DAF1 ] HidUsb C:\WINDOWS\system32\DRIVERS\hidusb.sys 08:50:30.0984 0968 HidUsb - ok 08:50:31.0015 0968 [ 8878BD685E490239777BFE51320B88E9 ] hkmsvc C:\WINDOWS\System32\kmsvc.dll 08:50:31.0015 0968 hkmsvc - ok 08:50:31.0031 0968 [ B028377DEA0546A5FCFBA928A8AEFAE0 ] hpn C:\WINDOWS\system32\DRIVERS\hpn.sys 08:50:31.0031 0968 hpn - ok 08:50:31.0078 0968 [ 77E4FF0B73BC0AEAAF39BF0C8104231F ] HSFHWBS2 C:\WINDOWS\system32\DRIVERS\HSFHWBS2.sys 08:50:31.0078 0968 HSFHWBS2 - ok 08:50:31.0156 0968 [ 60E1604729A15EF4A3B05F298427B3B1 ] HSF_DP C:\WINDOWS\system32\DRIVERS\HSF_DP.sys 08:50:31.0156 0968 HSF_DP - ok 08:50:31.0218 0968 [ F80A415EF82CD06FFAF0D971528EAD38 ] HTTP C:\WINDOWS\system32\Drivers\HTTP.sys 08:50:31.0218 0968 HTTP - ok 08:50:31.0234 0968 [ 6100A808600F44D999CEBDEF8841C7A3 ] HTTPFilter C:\WINDOWS\System32\w3ssl.dll 08:50:31.0250 0968 HTTPFilter - ok 08:50:31.0265 0968 [ 9368670BD426EBEA5E8B18A62416EC28 ] i2omgmt C:\WINDOWS\system32\drivers\i2omgmt.sys 08:50:31.0265 0968 i2omgmt - ok 08:50:31.0296 0968 [ F10863BF1CCC290BABD1A09188AE49E0 ] i2omp C:\WINDOWS\system32\DRIVERS\i2omp.sys 08:50:31.0296 0968 i2omp - ok 08:50:31.0312 0968 [ 4A0B06AA8943C1E332520F7440C0AA30 ] i8042prt C:\WINDOWS\system32\DRIVERS\i8042prt.sys 08:50:31.0312 0968 i8042prt - ok 08:50:31.0375 0968 [ C01AC32DC5C03076CFB852CB5DA5229C ] idsvc c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe 08:50:31.0375 0968 idsvc - ok 08:50:31.0468 0968 [ C19BF2A07BE972A110220DF6B1E89D14 ] IDSxpx86 C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\Definitions\IPSDefs\20121027.001\IDSxpx86.sys 08:50:31.0468 0968 IDSxpx86 - ok 08:50:31.0515 0968 [ 083A052659F5310DD8B6A6CB05EDCF8E ] Imapi C:\WINDOWS\system32\DRIVERS\imapi.sys 08:50:31.0515 0968 Imapi - ok 08:50:31.0562 0968 [ 30DEAF54A9755BB8546168CFE8A6B5E1 ] ImapiService C:\WINDOWS\system32\imapi.exe 08:50:31.0562 0968 ImapiService - ok 08:50:31.0593 0968 [ 4A40E045FAEE58631FD8D91AFC620719 ] ini910u C:\WINDOWS\system32\DRIVERS\ini910u.sys 08:50:31.0593 0968 ini910u - ok 08:50:31.0609 0968 [ B5466A9250342A7AA0CD1FBA13420678 ] IntelIde C:\WINDOWS\system32\DRIVERS\intelide.sys 08:50:31.0609 0968 IntelIde - ok 08:50:31.0640 0968 [ 8C953733D8F36EB2133F5BB58808B66B ] intelppm C:\WINDOWS\system32\DRIVERS\intelppm.sys 08:50:31.0640 0968 intelppm - ok 08:50:31.0750 0968 [ 3DC635B66DD7412E1C9C3A77B8D78F25 ] IntuitUpdateService C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe 08:50:31.0750 0968 IntuitUpdateService - ok 08:50:31.0796 0968 [ 1663A135865F0BA6E853353E98E67F2A ] IntuitUpdateServiceV4 C:\Program Files\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe 08:50:31.0796 0968 IntuitUpdateServiceV4 - ok 08:50:31.0828 0968 [ 3BB22519A194418D5FEC05D800A19AD0 ] Ip6Fw C:\WINDOWS\system32\drivers\ip6fw.sys 08:50:31.0828 0968 Ip6Fw - ok 08:50:31.0859 0968 [ 9EA02E03ED52D25551A6E46CF3B94B01 ] IPFilter C:\WINDOWS\system32\DRIVERS\IPFilter.sys 08:50:31.0859 0968 IPFilter - ok 08:50:31.0890 0968 [ 731F22BA402EE4B62748ADAF6363C182 ] IpFilterDriver C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys 08:50:31.0890 0968 IpFilterDriver - ok 08:50:31.0906 0968 [ B87AB476DCF76E72010632B5550955F5 ] IpInIp C:\WINDOWS\system32\DRIVERS\ipinip.sys 08:50:31.0906 0968 IpInIp - ok 08:50:31.0937 0968 [ CC748EA12C6EFFDE940EE98098BF96BB ] IpNat C:\WINDOWS\system32\DRIVERS\ipnat.sys 08:50:31.0937 0968 IpNat - ok 08:50:31.0984 0968 [ 23C74D75E36E7158768DD63D92789A91 ] IPSec C:\WINDOWS\system32\DRIVERS\ipsec.sys 08:50:31.0984 0968 IPSec - ok 08:50:32.0000 0968 [ C93C9FF7B04D772627A3646D89F7BF89 ] IRENUM C:\WINDOWS\system32\DRIVERS\irenum.sys 08:50:32.0000 0968 IRENUM - ok 08:50:32.0031 0968 [ 05A299EC56E52649B1CF2FC52D20F2D7 ] isapnp C:\WINDOWS\system32\DRIVERS\isapnp.sys 08:50:32.0031 0968 isapnp - ok 08:50:32.0031 0968 [ 463C1EC80CD17420A542B7F36A36F128 ] Kbdclass C:\WINDOWS\system32\DRIVERS\kbdclass.sys 08:50:32.0046 0968 Kbdclass - ok 08:50:32.0046 0968 [ 9EF487A186DEA361AA06913A75B3FA99 ] kbdhid C:\WINDOWS\system32\DRIVERS\kbdhid.sys 08:50:32.0046 0968 kbdhid - ok 08:50:32.0062 0968 [ 692BCF44383D056AED41B045A323D378 ] kmixer C:\WINDOWS\system32\drivers\kmixer.sys 08:50:32.0062 0968 kmixer - ok 08:50:32.0093 0968 [ B467646C54CC746128904E1654C750C1 ] KSecDD C:\WINDOWS\system32\drivers\KSecDD.sys 08:50:32.0093 0968 KSecDD - ok 08:50:32.0125 0968 [ 3A7C3CBE5D96B8AE96CE81F0B22FB527 ] lanmanserver C:\WINDOWS\System32\srvsvc.dll 08:50:32.0125 0968 lanmanserver - ok 08:50:32.0171 0968 [ A8888A5327621856C0CEC4E385F69309 ] lanmanworkstation C:\WINDOWS\System32\wkssvc.dll 08:50:32.0171 0968 lanmanworkstation - ok 08:50:32.0187 0968 lbrtfdc - ok 08:50:32.0234 0968 [ A1043645D16915DF12A6F2E049922A18 ] LexBceS C:\WINDOWS\system32\LEXBCES.EXE 08:50:32.0234 0968 LexBceS - ok 08:50:32.0265 0968 [ A7DB739AE99A796D91580147E919CC59 ] LmHosts C:\WINDOWS\System32\lmhsvc.dll 08:50:32.0265 0968 LmHosts - ok 08:50:32.0359 0968 [ 2144AE8412927E15119EE7303F8A5DF1 ] lxdfCATSCustConnectService C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxdfserv.exe 08:50:32.0359 0968 lxdfCATSCustConnectService - ok 08:50:32.0359 0968 lxdf_device - ok 08:50:32.0421 0968 [ DDF15A42E27E8EFE27B18FD403151A86 ] MatSvc C:\Program Files\Microsoft Fix it Center\Matsvc.exe 08:50:32.0437 0968 MatSvc - ok 08:50:32.0453 0968 [ DF0A511F38F16016BF658FCA0090CB87 ] McrdSvc C:\WINDOWS\ehome\mcrdsvc.exe 08:50:32.0468 0968 McrdSvc - ok 08:50:32.0468 0968 [ EEAEA6514BA7C9D273B5E87C4E1AAB30 ] mdmxsdk C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys 08:50:32.0468 0968 mdmxsdk - ok 08:50:32.0500 0968 [ 986B1FF5814366D71E0AC5755C88F2D3 ] Messenger C:\WINDOWS\System32\msgsvc.dll 08:50:32.0500 0968 Messenger - ok 08:50:32.0515 0968 [ B7521F69C0A9B29D356157229376FB21 ] MHN C:\WINDOWS\System32\mhn.dll 08:50:32.0515 0968 MHN - ok 08:50:32.0531 0968 [ 7F2F1D2815A6449D346FCCCBC569FBD6 ] MHNDRV C:\WINDOWS\system32\DRIVERS\mhndrv.sys 08:50:32.0531 0968 MHNDRV - ok 08:50:32.0562 0968 [ 4AE068242760A1FB6E1A44BF4E16AFA6 ] mnmdd C:\WINDOWS\system32\drivers\mnmdd.sys 08:50:32.0562 0968 mnmdd - ok 08:50:32.0593 0968 [ D18F1F0C101D06A1C1ADF26EED16FCDD ] mnmsrvc C:\WINDOWS\system32\mnmsrvc.exe 08:50:32.0593 0968 mnmsrvc - ok 08:50:32.0640 0968 [ DFCBAD3CEC1C5F964962AE10E0BCC8E1 ] Modem C:\WINDOWS\system32\drivers\Modem.sys 08:50:32.0640 0968 Modem - ok 08:50:32.0640 0968 [ 1992E0D143B09653AB0F9C5E04B0FD65 ] MODEMCSA C:\WINDOWS\system32\drivers\MODEMCSA.sys 08:50:32.0640 0968 MODEMCSA - ok 08:50:32.0656 0968 [ 35C9E97194C8CFB8430125F8DBC34D04 ] Mouclass C:\WINDOWS\system32\DRIVERS\mouclass.sys 08:50:32.0656 0968 Mouclass - ok 08:50:32.0687 0968 [ B1C303E17FB9D46E87A98E4BA6769685 ] mouhid C:\WINDOWS\system32\DRIVERS\mouhid.sys 08:50:32.0687 0968 mouhid - ok 08:50:32.0703 0968 [ A80B9A0BAD1B73637DBCBBA7DF72D3FD ] MountMgr C:\WINDOWS\system32\drivers\MountMgr.sys 08:50:32.0703 0968 MountMgr - ok 08:50:32.0750 0968 [ 3F4BB95E5A44F3BE34824E8E7CAF0737 ] mraid35x C:\WINDOWS\system32\DRIVERS\mraid35x.sys 08:50:32.0750 0968 mraid35x - ok 08:50:32.0750 0968 [ 11D42BB6206F33FBB3BA0288D3EF81BD ] MRxDAV C:\WINDOWS\system32\DRIVERS\mrxdav.sys 08:50:32.0765 0968 MRxDAV - ok 08:50:32.0812 0968 [ 7D304A5EB4344EBEEAB53A2FE3FFB9F0 ] MRxSmb C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 08:50:32.0812 0968 MRxSmb - ok 08:50:32.0859 0968 [ A137F1470499A205ABBB9AAFB3B6F2B1 ] MSDTC C:\WINDOWS\system32\msdtc.exe 08:50:32.0859 0968 MSDTC - ok 08:50:32.0890 0968 [ C941EA2454BA8350021D774DAF0F1027 ] Msfs C:\WINDOWS\system32\drivers\Msfs.sys 08:50:32.0890 0968 Msfs - ok 08:50:32.0906 0968 MSIServer - ok 08:50:32.0921 0968 [ D1575E71568F4D9E14CA56B7B0453BF1 ] MSKSSRV C:\WINDOWS\system32\drivers\MSKSSRV.sys 08:50:32.0921 0968 MSKSSRV - ok 08:50:32.0937 0968 [ 325BB26842FC7CCC1FCCE2C457317F3E ] MSPCLOCK C:\WINDOWS\system32\drivers\MSPCLOCK.sys 08:50:32.0937 0968 MSPCLOCK - ok 08:50:32.0953 0968 [ BAD59648BA099DA4A17680B39730CB3D ] MSPQM C:\WINDOWS\system32\drivers\MSPQM.sys 08:50:32.0953 0968 MSPQM - ok 08:50:32.0984 0968 [ AF5F4F3F14A8EA2C26DE30F7A1E17136 ] mssmbios C:\WINDOWS\system32\DRIVERS\mssmbios.sys 08:50:33.0000 0968 mssmbios - ok 08:50:33.0015 0968 [ DE6A75F5C270E756C5508D94B6CF68F5 ] Mup C:\WINDOWS\system32\drivers\Mup.sys 08:50:33.0015 0968 Mup - ok 08:50:33.0109 0968 [ F2840DBFE9322F35557219AE82CC4597 ] N360 C:\Program Files\Norton Security Suite\Engine\6.4.0.9\ccSvcHst.exe 08:50:33.0109 0968 N360 - ok 08:50:33.0140 0968 [ 0102140028FAD045756796E1C685D695 ] napagent C:\WINDOWS\System32\qagentrt.dll 08:50:33.0140 0968 napagent - ok 08:50:33.0234 0968 [ 8E4C77AD9BB279900C00F870CC0C674B ] NAVENG C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\Definitions\VirusDefs\20121027.007\NAVENG.SYS 08:50:33.0234 0968 NAVENG - ok 08:50:33.0296 0968 [ 826F699B69E88A3920C70F344DD42D88 ] NAVEX15 C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\Definitions\VirusDefs\20121027.007\NAVEX15.SYS 08:50:33.0296 0968 NAVEX15 - ok 08:50:33.0343 0968 [ 1DF7F42665C94B825322FAE71721130D ] NDIS C:\WINDOWS\system32\drivers\NDIS.sys 08:50:33.0343 0968 NDIS - ok 08:50:33.0390 0968 [ 0109C4F3850DFBAB279542515386AE22 ] NdisTapi C:\WINDOWS\system32\DRIVERS\ndistapi.sys 08:50:33.0390 0968 NdisTapi - ok 08:50:33.0406 0968 [ F927A4434C5028758A842943EF1A3849 ] Ndisuio C:\WINDOWS\system32\DRIVERS\ndisuio.sys 08:50:33.0406 0968 Ndisuio - ok 08:50:33.0437 0968 [ EDC1531A49C80614B2CFDA43CA8659AB ] NdisWan C:\WINDOWS\system32\DRIVERS\ndiswan.sys 08:50:33.0437 0968 NdisWan - ok 08:50:33.0468 0968 [ 9282BD12DFB069D3889EB3FCC1000A9B ] NDProxy C:\WINDOWS\system32\drivers\NDProxy.sys 08:50:33.0468 0968 NDProxy - ok 08:50:33.0484 0968 [ 5D81CF9A2F1A3A756B66CF684911CDF0 ] NetBIOS C:\WINDOWS\system32\DRIVERS\netbios.sys 08:50:33.0484 0968 NetBIOS - ok 08:50:33.0500 0968 [ 74B2B2F5BEA5E9A3DC021D685551BD3D ] NetBT C:\WINDOWS\system32\DRIVERS\netbt.sys 08:50:33.0500 0968 NetBT - ok 08:50:33.0546 0968 [ B857BA82860D7FF85AE29B095645563B ] NetDDE C:\WINDOWS\system32\netdde.exe 08:50:33.0546 0968 NetDDE - ok 08:50:33.0546 0968 [ B857BA82860D7FF85AE29B095645563B ] NetDDEdsdm C:\WINDOWS\system32\netdde.exe 08:50:33.0546 0968 NetDDEdsdm - ok 08:50:33.0578 0968 [ BF2466B3E18E970D8A976FB95FC1CA85 ] Netlogon C:\WINDOWS\system32\lsass.exe 08:50:33.0593 0968 Netlogon - ok 08:50:33.0609 0968 [ 13E67B55B3ABD7BF3FE7AAE5A0F9A9DE ] Netman C:\WINDOWS\System32\netman.dll 08:50:33.0609 0968 Netman - ok 08:50:33.0703 0968 [ 9DA26B773BD04B867A8E9F427CD048FC ] NetSvc C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe 08:50:33.0718 0968 NetSvc - ok 08:50:33.0750 0968 [ D34612C5D02D026535B3095D620626AE ] NetTcpPortSharing c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe 08:50:33.0750 0968 NetTcpPortSharing - ok 08:50:33.0796 0968 [ 943337D786A56729263071623BBB9DE5 ] Nla C:\WINDOWS\System32\mswsock.dll 08:50:33.0796 0968 Nla - ok 08:50:33.0828 0968 [ 3182D64AE053D6FB034F44B6DEF8034A ] Npfs C:\WINDOWS\system32\drivers\Npfs.sys 08:50:33.0828 0968 Npfs - ok 08:50:33.0843 0968 [ 78A08DD6A8D65E697C18E1DB01C5CDCA ] Ntfs C:\WINDOWS\system32\drivers\Ntfs.sys 08:50:33.0843 0968 Ntfs - ok 08:50:33.0843 0968 [ BF2466B3E18E970D8A976FB95FC1CA85 ] NtLmSsp C:\WINDOWS\system32\lsass.exe 08:50:33.0859 0968 NtLmSsp - ok 08:50:33.0875 0968 [ 156F64A3345BD23C600655FB4D10BC08 ] NtmsSvc C:\WINDOWS\system32\ntmssvc.dll 08:50:33.0890 0968 NtmsSvc - ok 08:50:33.0906 0968 [ 73C1E1F395918BC2C6DD67AF7591A3AD ] Null C:\WINDOWS\system32\drivers\Null.sys 08:50:33.0906 0968 Null - ok 08:50:33.0984 0968 [ 2B298519EDBFCF451D43E0F1E8F1006D ] nv C:\WINDOWS\system32\DRIVERS\nv4_mini.sys 08:50:34.0000 0968 nv - ok 08:50:34.0000 0968 [ B305F3FAD35083837EF46A0BBCE2FC57 ] NwlnkFlt C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys 08:50:34.0015 0968 NwlnkFlt - ok 08:50:34.0031 0968 [ C99B3415198D1AAB7227F2C88FD664B9 ] NwlnkFwd C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys 08:50:34.0031 0968 NwlnkFwd - ok 08:50:34.0156 0968 [ 4A6F8568C9AD6550943DCE9B818E396D ] OpenVPNService C:\Download\OpenVPN\bin\openvpnserv.exe 08:50:34.0156 0968 OpenVPNService - ok 08:50:34.0187 0968 [ 5575FAF8F97CE5E713D108C2A58D7C7C ] Parport C:\WINDOWS\system32\DRIVERS\parport.sys 08:50:34.0187 0968 Parport - ok 08:50:34.0234 0968 [ BEB3BA25197665D82EC7065B724171C6 ] PartMgr C:\WINDOWS\system32\drivers\PartMgr.sys 08:50:34.0234 0968 PartMgr - ok 08:50:34.0250 0968 [ 70E98B3FD8E963A6A46A2E6247E0BEA1 ] ParVdm C:\WINDOWS\system32\drivers\ParVdm.sys 08:50:34.0250 0968 ParVdm - ok 08:50:34.0265 0968 [ A219903CCF74233761D92BEF471A07B1 ] PCI C:\WINDOWS\system32\DRIVERS\pci.sys 08:50:34.0265 0968 PCI - ok 08:50:34.0265 0968 PCIDump - ok 08:50:34.0296 0968 [ CCF5F451BB1A5A2A522A76E670000FF0 ] PCIIde C:\WINDOWS\system32\DRIVERS\pciide.sys 08:50:34.0312 0968 PCIIde - ok 08:50:34.0328 0968 [ 9E89EF60E9EE05E3F2EEF2DA7397F1C1 ] Pcmcia C:\WINDOWS\system32\drivers\Pcmcia.sys 08:50:34.0328 0968 Pcmcia - ok 08:50:34.0343 0968 PDCOMP - ok 08:50:34.0343 0968 PDFRAME - ok 08:50:34.0343 0968 PDRELI - ok 08:50:34.0359 0968 PDRFRAME - ok 08:50:34.0406 0968 [ 6C14B9C19BA84F73D3A86DBA11133101 ] perc2 C:\WINDOWS\system32\DRIVERS\perc2.sys 08:50:34.0406 0968 perc2 - ok 08:50:34.0406 0968 [ F50F7C27F131AFE7BEBA13E14A3B9416 ] perc2hib C:\WINDOWS\system32\DRIVERS\perc2hib.sys 08:50:34.0406 0968 perc2hib - ok 08:50:34.0453 0968 [ 65DF52F5B8B6E9BBD183505225C37315 ] PlugPlay C:\WINDOWS\system32\services.exe 08:50:34.0453 0968 PlugPlay - ok 08:50:34.0484 0968 [ E4910CE9D882BF825979FCF4636A9BD8 ] Point32 C:\WINDOWS\system32\DRIVERS\point32.sys 08:50:34.0484 0968 Point32 - ok 08:50:34.0515 0968 [ BF2466B3E18E970D8A976FB95FC1CA85 ] PolicyAgent C:\WINDOWS\system32\lsass.exe 08:50:34.0515 0968 PolicyAgent - ok 08:50:34.0531 0968 [ EFEEC01B1D3CF84F16DDD24D9D9D8F99 ] PptpMiniport C:\WINDOWS\system32\DRIVERS\raspptp.sys 08:50:34.0531 0968 PptpMiniport - ok 08:50:34.0531 0968 [ BF2466B3E18E970D8A976FB95FC1CA85 ] ProtectedStorage C:\WINDOWS\system32\lsass.exe 08:50:34.0531 0968 ProtectedStorage - ok 08:50:34.0546 0968 [ 09298EC810B07E5D582CB3A3F9255424 ] PSched C:\WINDOWS\system32\DRIVERS\psched.sys 08:50:34.0546 0968 PSched - ok 08:50:34.0546 0968 [ 80D317BD1C3DBC5D4FE7B1678C60CADD ] Ptilink C:\WINDOWS\system32\DRIVERS\ptilink.sys 08:50:34.0546 0968 Ptilink - ok 08:50:34.0593 0968 ptssvc - ok 08:50:34.0625 0968 [ 86724469CD077901706854974CD13C3E ] PxHelp20 C:\WINDOWS\system32\Drivers\PxHelp20.sys 08:50:34.0625 0968 PxHelp20 - ok 08:50:34.0656 0968 [ 0A63FB54039EB5662433CABA3B26DBA7 ] ql1080 C:\WINDOWS\system32\DRIVERS\ql1080.sys 08:50:34.0656 0968 ql1080 - ok 08:50:34.0671 0968 [ 6503449E1D43A0FF0201AD5CB1B8C706 ] Ql10wnt C:\WINDOWS\system32\DRIVERS\ql10wnt.sys 08:50:34.0671 0968 Ql10wnt - ok 08:50:34.0687 0968 [ 156ED0EF20C15114CA097A34A30D8A01 ] ql12160 C:\WINDOWS\system32\DRIVERS\ql12160.sys 08:50:34.0687 0968 ql12160 - ok 08:50:34.0703 0968 [ 70F016BEBDE6D29E864C1230A07CC5E6 ] ql1240 C:\WINDOWS\system32\DRIVERS\ql1240.sys 08:50:34.0703 0968 ql1240 - ok 08:50:34.0718 0968 [ 907F0AEEA6BC451011611E732BD31FCF ] ql1280 C:\WINDOWS\system32\DRIVERS\ql1280.sys 08:50:34.0718 0968 ql1280 - ok 08:50:34.0734 0968 [ FE0D99D6F31E4FAD8159F690D68DED9C ] RasAcd C:\WINDOWS\system32\DRIVERS\rasacd.sys 08:50:34.0734 0968 RasAcd - ok 08:50:34.0781 0968 [ AD188BE7BDF94E8DF4CA0A55C00A5073 ] RasAuto C:\WINDOWS\System32\rasauto.dll 08:50:34.0781 0968 RasAuto - ok 08:50:34.0796 0968 [ 11B4A627BC9614B885C4969BFA5FF8A6 ] Rasl2tp C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 08:50:34.0796 0968 Rasl2tp - ok 08:50:34.0828 0968 [ 76A9A3CBEADD68CC57CDA5E1D7448235 ] RasMan C:\WINDOWS\System32\rasmans.dll 08:50:34.0828 0968 RasMan - ok 08:50:34.0828 0968 [ 5BC962F2654137C9909C3D4603587DEE ] RasPppoe C:\WINDOWS\system32\DRIVERS\raspppoe.sys 08:50:34.0828 0968 RasPppoe - ok 08:50:34.0828 0968 [ FDBB1D60066FCFBB7452FD8F9829B242 ] Raspti C:\WINDOWS\system32\DRIVERS\raspti.sys 08:50:34.0843 0968 Raspti - ok 08:50:34.0859 0968 [ 7AD224AD1A1437FE28D89CF22B17780A ] Rdbss C:\WINDOWS\system32\DRIVERS\rdbss.sys 08:50:34.0875 0968 Rdbss - ok 08:50:34.0875 0968 [ 4912D5B403614CE99C28420F75353332 ] RDPCDD C:\WINDOWS\system32\DRIVERS\RDPCDD.sys 08:50:34.0875 0968 RDPCDD - ok 08:50:34.0890 0968 [ 15CABD0F7C00C47C70124907916AF3F1 ] rdpdr C:\WINDOWS\system32\DRIVERS\rdpdr.sys 08:50:34.0890 0968 rdpdr - ok 08:50:34.0921 0968 [ 43AF5212BD8FB5BA6EED9754358BD8F7 ] RDPWD C:\WINDOWS\system32\drivers\RDPWD.sys 08:50:34.0937 0968 RDPWD - ok 08:50:34.0953 0968 [ 3C37BF86641BDA977C3BF8A840F3B7FA ] RDSessMgr C:\WINDOWS\system32\sessmgr.exe 08:50:34.0953 0968 RDSessMgr - ok 08:50:34.0984 0968 [ F828DD7E1419B6653894A8F97A0094C5 ] redbook C:\WINDOWS\system32\DRIVERS\redbook.sys 08:50:34.0984 0968 redbook - ok 08:50:35.0000 0968 [ 7E699FF5F59B5D9DE5390E3C34C67CF5 ] RemoteAccess C:\WINDOWS\System32\mprdim.dll 08:50:35.0015 0968 RemoteAccess - ok 08:50:35.0046 0968 [ 5B19B557B0C188210A56A6B699D90B8F ] RemoteRegistry C:\WINDOWS\system32\regsvc.dll 08:50:35.0046 0968 RemoteRegistry - ok 08:50:35.0078 0968 [ AAED593F84AFA419BBAE8572AF87CF6A ] RpcLocator C:\WINDOWS\system32\locator.exe 08:50:35.0078 0968 RpcLocator - ok 08:50:35.0109 0968 [ 6B27A5C03DFB94B4245739065431322C ] RpcSs C:\WINDOWS\System32\rpcss.dll 08:50:35.0109 0968 RpcSs - ok 08:50:35.0140 0968 [ 471B3F9741D762ABE75E9DEEA4787E47 ] RSVP C:\WINDOWS\system32\rsvp.exe 08:50:35.0156 0968 RSVP - ok 08:50:35.0171 0968 [ BF2466B3E18E970D8A976FB95FC1CA85 ] SamSs C:\WINDOWS\system32\lsass.exe 08:50:35.0171 0968 SamSs - ok 08:50:35.0203 0968 [ 86D007E7A654B9A71D1D7D856B104353 ] SCardSvr C:\WINDOWS\System32\SCardSvr.exe 08:50:35.0203 0968 SCardSvr - ok 08:50:35.0250 0968 [ 0A9A7365A1CA4319AA7C1D6CD8E4EAFA ] Schedule C:\WINDOWS\system32\schedsvc.dll 08:50:35.0250 0968 Schedule - ok 08:50:35.0281 0968 [ 90A3935D05B494A5A39D37E71F09A677 ] Secdrv C:\WINDOWS\system32\DRIVERS\secdrv.sys 08:50:35.0281 0968 Secdrv - ok 08:50:35.0328 0968 [ CBE612E2BB6A10E3563336191EDA1250 ] seclogon C:\WINDOWS\System32\seclogon.dll 08:50:35.0328 0968 seclogon - ok 08:50:35.0359 0968 [ 7FDD5D0684ECA8C1F68B4D99D124DCD0 ] SENS C:\WINDOWS\system32\sens.dll 08:50:35.0359 0968 SENS - ok 08:50:35.0390 0968 [ 0F29512CCD6BEAD730039FB4BD2C85CE ] serenum C:\WINDOWS\system32\DRIVERS\serenum.sys 08:50:35.0390 0968 serenum - ok 08:50:35.0421 0968 [ CCA207A8896D4C6A0C9CE29A4AE411A7 ] Serial C:\WINDOWS\system32\DRIVERS\serial.sys 08:50:35.0421 0968 Serial - ok 08:50:35.0468 0968 [ 8E6B8C671615D126FDC553D1E2DE5562 ] Sfloppy C:\WINDOWS\system32\drivers\Sfloppy.sys 08:50:35.0468 0968 Sfloppy - ok 08:50:35.0515 0968 [ 83F41D0D89645D7235C051AB1D9523AC ] SharedAccess C:\WINDOWS\System32\ipnathlp.dll 08:50:35.0515 0968 SharedAccess - ok 08:50:35.0562 0968 [ 99BC0B50F511924348BE19C7C7313BBF ] ShellHWDetection C:\WINDOWS\System32\shsvcs.dll 08:50:35.0562 0968 ShellHWDetection - ok 08:50:35.0562 0968 Simbad - ok 08:50:35.0593 0968 [ 6B33D0EBD30DB32E27D1D78FE946A754 ] sisagp C:\WINDOWS\system32\DRIVERS\sisagp.sys 08:50:35.0609 0968 sisagp - ok 08:50:35.0625 0968 [ 83C0F71F86D3BDAF915685F3D568B20E ] Sparrow C:\WINDOWS\system32\DRIVERS\sparrow.sys 08:50:35.0625 0968 Sparrow - ok 08:50:35.0640 0968 [ AB8B92451ECB048A4D1DE7C3FFCB4A9F ] splitter C:\WINDOWS\system32\drivers\splitter.sys 08:50:35.0640 0968 splitter - ok 08:50:35.0687 0968 [ 60784F891563FB1B767F70117FC2428F ] Spooler C:\WINDOWS\system32\spoolsv.exe 08:50:35.0687 0968 Spooler - ok 08:50:35.0703 0968 [ 76BB022C2FB6902FD5BDD4F78FC13A5D ] sr C:\WINDOWS\system32\DRIVERS\sr.sys 08:50:35.0703 0968 sr - ok 08:50:35.0750 0968 [ 3805DF0AC4296A34BA4BF93B346CC378 ] srservice C:\WINDOWS\system32\srsvc.dll 08:50:35.0750 0968 srservice - ok 08:50:35.0843 0968 [ 7BB297CADA42903328E92425D9761DA6 ] SRTSP C:\WINDOWS\System32\Drivers\N360\0604000.009\SRTSP.SYS 08:50:35.0859 0968 SRTSP - ok 08:50:35.0890 0968 [ 475FCF0F28D845BF1C8ABAC27F19003E ] SRTSPX C:\WINDOWS\system32\drivers\N360\0604000.009\SRTSPX.SYS 08:50:35.0890 0968 SRTSPX - ok 08:50:35.0953 0968 [ 47DDFC2F003F7F9F0592C6874962A2E7 ] Srv C:\WINDOWS\system32\DRIVERS\srv.sys 08:50:35.0953 0968 Srv - ok 08:50:36.0000 0968 [ 0A5679B3714EDAB99E357057EE88FCA6 ] SSDPSRV C:\WINDOWS\System32\ssdpsrv.dll 08:50:36.0000 0968 SSDPSRV - ok 08:50:36.0062 0968 [ 2A2DC39623ADEF8AB3703AB9FAC4B440 ] STHDA C:\WINDOWS\system32\drivers\sthda.sys 08:50:36.0078 0968 STHDA - ok 08:50:36.0109 0968 [ 8BAD69CBAC032D4BBACFCE0306174C30 ] stisvc C:\WINDOWS\system32\wiaservc.dll 08:50:36.0125 0968 stisvc - ok 08:50:36.0156 0968 [ 3941D127AEF12E93ADDF6FE6EE027E0F ] swenum C:\WINDOWS\system32\DRIVERS\swenum.sys 08:50:36.0156 0968 swenum - ok 08:50:36.0203 0968 [ 8CE882BCC6CF8A62F2B2323D95CB3D01 ] swmidi C:\WINDOWS\system32\drivers\swmidi.sys 08:50:36.0203 0968 swmidi - ok 08:50:36.0203 0968 SwPrv - ok 08:50:36.0265 0968 [ 267C914667C94E5F47D342311C1C577F ] Symantec RemoteAssist C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe 08:50:36.0265 0968 Symantec RemoteAssist - ok 08:50:36.0281 0968 [ 1FF3217614018630D0A6758630FC698C ] symc810 C:\WINDOWS\system32\DRIVERS\symc810.sys 08:50:36.0281 0968 symc810 - ok 08:50:36.0296 0968 [ 070E001D95CF725186EF8B20335F933C ] symc8xx C:\WINDOWS\system32\DRIVERS\symc8xx.sys 08:50:36.0296 0968 symc8xx - ok 08:50:36.0328 0968 [ 690FA0E61B90084C4D9A721BD4F3D779 ] SymDS C:\WINDOWS\system32\drivers\N360\0604000.009\SYMDS.SYS 08:50:36.0328 0968 SymDS - ok 08:50:36.0375 0968 [ 8F88EDB211B12537D2DC2A6D73D6067C ] SymEFA C:\WINDOWS\system32\drivers\N360\0604000.009\SYMEFA.SYS 08:50:36.0390 0968 SymEFA - ok 08:50:36.0421 0968 [ 74E2521E96176A4449570E50BE91954D ] SymEvent C:\WINDOWS\system32\Drivers\SYMEVENT.SYS 08:50:36.0421 0968 SymEvent - ok 08:50:36.0468 0968 [ A7100EA17ED9EAF365362A05BF430E77 ] SymIM C:\WINDOWS\system32\DRIVERS\SymIM.sys 08:50:36.0468 0968 SymIM - ok 08:50:36.0468 0968 [ A7100EA17ED9EAF365362A05BF430E77 ] SymIMMP C:\WINDOWS\system32\DRIVERS\SymIM.sys 08:50:36.0468 0968 SymIMMP - ok 08:50:36.0515 0968 [ 2C356CCA706505CF63CBE39D532B9236 ] SymIRON C:\WINDOWS\system32\drivers\N360\0604000.009\Ironx86.SYS 08:50:36.0515 0968 SymIRON - ok 08:50:36.0562 0968 [ 508BD882040F9CB12319E3A4FC78EDB9 ] SYMTDI C:\WINDOWS\System32\Drivers\N360\0604000.009\SYMTDI.SYS 08:50:36.0578 0968 SYMTDI - ok 08:50:36.0593 0968 [ 80AC1C4ABBE2DF3B738BF15517A51F2C ] sym_hi C:\WINDOWS\system32\DRIVERS\sym_hi.sys 08:50:36.0593 0968 sym_hi - ok 08:50:36.0609 0968 [ BF4FAB949A382A8E105F46EBB4937058 ] sym_u3 C:\WINDOWS\system32\DRIVERS\sym_u3.sys 08:50:36.0609 0968 sym_u3 - ok 08:50:36.0640 0968 [ 8B83F3ED0F1688B4958F77CD6D2BF290 ] sysaudio C:\WINDOWS\system32\drivers\sysaudio.sys 08:50:36.0640 0968 sysaudio - ok 08:50:36.0687 0968 [ C7ABBC59B43274B1109DF6B24D617051 ] SysmonLog C:\WINDOWS\system32\smlogsvc.exe 08:50:36.0687 0968 SysmonLog - ok 08:50:36.0718 0968 [ 846B7C0E3F6370CDCCE157A5B36E70CD ] tap0801 C:\WINDOWS\system32\DRIVERS\tap0801.sys 08:50:36.0718 0968 tap0801 - ok 08:50:36.0750 0968 [ 3CB78C17BB664637787C9A1C98F79C38 ] TapiSrv C:\WINDOWS\System32\tapisrv.dll 08:50:36.0750 0968 TapiSrv - ok 08:50:36.0796 0968 [ 9AEFA14BD6B182D61E3119FA5F436D3D ] Tcpip C:\WINDOWS\system32\DRIVERS\tcpip.sys 08:50:36.0812 0968 Tcpip - ok 08:50:36.0843 0968 [ 6471A66807F5E104E4885F5B67349397 ] TDPIPE C:\WINDOWS\system32\drivers\TDPIPE.sys 08:50:36.0859 0968 TDPIPE - ok 08:50:36.0875 0968 [ C56B6D0402371CF3700EB322EF3AAF61 ] TDTCP C:\WINDOWS\system32\drivers\TDTCP.sys 08:50:36.0875 0968 TDTCP - ok 08:50:36.0890 0968 [ 88155247177638048422893737429D9E ] TermDD C:\WINDOWS\system32\DRIVERS\termdd.sys 08:50:36.0890 0968 TermDD - ok 08:50:36.0953 0968 [ FF3477C03BE7201C294C35F684B3479F ] TermService C:\WINDOWS\System32\termsrv.dll 08:50:36.0953 0968 TermService - ok 08:50:36.0984 0968 [ 99BC0B50F511924348BE19C7C7313BBF ] Themes C:\WINDOWS\System32\shsvcs.dll 08:50:36.0984 0968 Themes - ok 08:50:37.0031 0968 [ DB7205804759FF62C34E3EFD8A4CC76A ] TlntSvr C:\WINDOWS\system32\tlntsvr.exe 08:50:37.0031 0968 TlntSvr - ok 08:50:37.0031 0968 [ F2790F6AF01321B172AA62F8E1E187D9 ] TosIde C:\WINDOWS\system32\DRIVERS\toside.sys 08:50:37.0031 0968 TosIde - ok 08:50:37.0062 0968 [ 55BCA12F7F523D35CA3CB833C725F54E ] TrkWks C:\WINDOWS\system32\trkwks.dll 08:50:37.0062 0968 TrkWks - ok 08:50:37.0093 0968 [ 5787B80C2E3C5E2F56C2A233D91FA2C9 ] Udfs C:\WINDOWS\system32\drivers\Udfs.sys 08:50:37.0093 0968 Udfs - ok 08:50:37.0125 0968 [ 1B698A51CD528D8DA4FFAED66DFC51B9 ] ultra C:\WINDOWS\system32\DRIVERS\ultra.sys 08:50:37.0125 0968 ultra - ok 08:50:37.0171 0968 [ 402DDC88356B1BAC0EE3DD1580C76A31 ] Update C:\WINDOWS\system32\DRIVERS\update.sys 08:50:37.0171 0968 Update - ok 08:50:37.0203 0968 [ 1EBAFEB9A3FBDC41B8D9C7F0F687AD91 ] upnphost C:\WINDOWS\System32\upnphost.dll 08:50:37.0218 0968 upnphost - ok 08:50:37.0234 0968 [ 05365FB38FCA1E98F7A566AAAF5D1815 ] UPS C:\WINDOWS\System32\ups.exe 08:50:37.0234 0968 UPS - ok 08:50:37.0281 0968 [ 173F317CE0DB8E21322E71B7E60A27E8 ] usbccgp C:\WINDOWS\system32\DRIVERS\usbccgp.sys 08:50:37.0281 0968 usbccgp - ok 08:50:37.0296 0968 [ 65DCF09D0E37D4C6B11B5B0B76D470A7 ] usbehci C:\WINDOWS\system32\DRIVERS\usbehci.sys 08:50:37.0296 0968 usbehci - ok 08:50:37.0328 0968 [ 1AB3CDDE553B6E064D2E754EFE20285C ] usbhub C:\WINDOWS\system32\DRIVERS\usbhub.sys 08:50:37.0328 0968 usbhub - ok 08:50:37.0375 0968 [ A717C8721046828520C9EDF31288FC00 ] usbprint C:\WINDOWS\system32\DRIVERS\usbprint.sys 08:50:37.0375 0968 usbprint - ok 08:50:37.0390 0968 [ A0B8CF9DEB1184FBDD20784A58FA75D4 ] usbscan C:\WINDOWS\system32\DRIVERS\usbscan.sys 08:50:37.0390 0968 usbscan - ok 08:50:37.0390 0968 [ A32426D9B14A089EAA1D922E0C5801A9 ] USBSTOR C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS 08:50:37.0406 0968 USBSTOR - ok 08:50:37.0421 0968 [ 26496F9DEE2D787FC3E61AD54821FFE6 ] usbuhci C:\WINDOWS\system32\DRIVERS\usbuhci.sys 08:50:37.0421 0968 usbuhci - ok 08:50:37.0437 0968 [ 0D3A8FAFCEACD8B7625CD549757A7DF1 ] VgaSave C:\WINDOWS\System32\drivers\vga.sys 08:50:37.0437 0968 VgaSave - ok 08:50:37.0453 0968 [ 754292CE5848B3738281B4F3607EAEF4 ] viaagp C:\WINDOWS\system32\DRIVERS\viaagp.sys 08:50:37.0453 0968 viaagp - ok 08:50:37.0468 0968 [ 3B3EFCDA263B8AC14FDF9CBDD0791B2E ] ViaIde C:\WINDOWS\system32\DRIVERS\viaide.sys 08:50:37.0468 0968 ViaIde - ok 08:50:37.0500 0968 [ 4C8FCB5CC53AAB716D810740FE59D025 ] VolSnap C:\WINDOWS\system32\drivers\VolSnap.sys 08:50:37.0500 0968 VolSnap - ok 08:50:37.0546 0968 [ 7A9DB3A67C333BF0BD42E42B8596854B ] VSS C:\WINDOWS\System32\vssvc.exe 08:50:37.0546 0968 VSS - ok 08:50:37.0578 0968 [ 54AF4B1D5459500EF0937F6D33B1914F ] w32time C:\WINDOWS\system32\w32time.dll 08:50:37.0578 0968 w32time - ok 08:50:37.0593 0968 [ E20B95BAEDB550F32DD489265C1DA1F6 ] Wanarp C:\WINDOWS\system32\DRIVERS\wanarp.sys 08:50:37.0593 0968 Wanarp - ok 08:50:37.0609 0968 wanatw - ok 08:50:37.0609 0968 WDICA - ok 08:50:37.0656 0968 [ 6768ACF64B18196494413695F0C3A00F ] wdmaud C:\WINDOWS\system32\drivers\wdmaud.sys 08:50:37.0656 0968 wdmaud - ok 08:50:37.0671 0968 [ 77A354E28153AD2D5E120A5A8687BC06 ] WebClient C:\WINDOWS\System32\webclnt.dll 08:50:37.0671 0968 WebClient - ok 08:50:37.0703 0968 [ F59ED5A43B988A18EF582BB07B2327A7 ] winachsf C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys 08:50:37.0703 0968 winachsf - ok 08:50:37.0796 0968 [ 2D0E4ED081963804CCC196A0929275B5 ] winmgmt C:\WINDOWS\system32\wbem\WMIsvc.dll 08:50:37.0796 0968 winmgmt - ok 08:50:37.0843 0968 [ C51B4A5C05A5475708E3C81C7765B71D ] WmdmPmSN C:\WINDOWS\system32\MsPMSNSv.dll 08:50:37.0843 0968 WmdmPmSN - ok 08:50:37.0890 0968 [ E76F8807070ED04E7408A86D6D3A6137 ] Wmi C:\WINDOWS\System32\advapi32.dll 08:50:37.0890 0968 Wmi - ok 08:50:37.0937 0968 [ E0673F1106E62A68D2257E376079F821 ] WmiApSrv C:\WINDOWS\system32\wbem\wmiapsrv.exe 08:50:37.0937 0968 WmiApSrv - ok 08:50:38.0015 0968 [ F74E3D9A7FA9556C3BBB14D4E5E63D3B ] WMPNetworkSvc C:\Program Files\Windows Media Player\WMPNetwk.exe 08:50:38.0031 0968 WMPNetworkSvc - ok 08:50:38.0125 0968 [ DCF3E3EDF5109EE8BC02FE6E1F045795 ] WPFFontCache_v0400 C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe 08:50:38.0140 0968 WPFFontCache_v0400 - ok 08:50:38.0171 0968 [ 6ABE6E225ADB5A751622A9CC3BC19CE8 ] WS2IFSL C:\WINDOWS\System32\drivers\ws2ifsl.sys 08:50:38.0171 0968 WS2IFSL - ok 08:50:38.0234 0968 [ 7C278E6408D1DCE642230C0585A854D5 ] wscsvc C:\WINDOWS\system32\wscsvc.dll 08:50:38.0234 0968 wscsvc - ok 08:50:38.0265 0968 [ 35321FB577CDC98CE3EB3A3EB9E4610A ] wuauserv C:\WINDOWS\system32\wuauserv.dll 08:50:38.0265 0968 wuauserv - ok 08:50:38.0312 0968 [ F15FEAFFFBB3644CCC80C5DA584E6311 ] WudfPf C:\WINDOWS\system32\DRIVERS\WudfPf.sys 08:50:38.0312 0968 WudfPf - ok 08:50:38.0359 0968 [ 05231C04253C5BC30B26CBAAE680ED89 ] WudfSvc C:\WINDOWS\System32\WUDFSvc.dll 08:50:38.0359 0968 WudfSvc - ok 08:50:38.0437 0968 [ 81DC3F549F44B1C1FFF022DEC9ECF30B ] WZCSVC C:\WINDOWS\System32\wzcsvc.dll 08:50:38.0437 0968 WZCSVC - ok 08:50:38.0484 0968 [ 295D21F14C335B53CB8154E5B1F892B9 ] xmlprov C:\WINDOWS\System32\xmlprov.dll 08:50:38.0484 0968 xmlprov - ok 08:50:38.0484 0968 ================ Scan global =============================== 08:50:38.0531 0968 [ 42F1F4C0AFB08410E5F02D4B13EBB623 ] C:\WINDOWS\system32\basesrv.dll 08:50:38.0562 0968 [ 8C7DCA4B158BF16894120786A7A5F366 ] C:\WINDOWS\system32\winsrv.dll 08:50:38.0593 0968 [ 8C7DCA4B158BF16894120786A7A5F366 ] C:\WINDOWS\system32\winsrv.dll 08:50:38.0609 0968 [ 65DF52F5B8B6E9BBD183505225C37315 ] C:\WINDOWS\system32\services.exe 08:50:38.0609 0968 [Global] - ok 08:50:38.0609 0968 ================ Scan MBR ================================== 08:50:38.0625 0968 [ 5CB90281D1A59B251F6603134774EEC3 ] \Device\Harddisk0\DR0 08:50:38.0781 0968 \Device\Harddisk0\DR0 - ok 08:50:38.0781 0968 ================ Scan VBR ================================== 08:50:38.0796 0968 [ FFD0043B9BF911031772A758ABE53596 ] \Device\Harddisk0\DR0\Partition1 08:50:38.0796 0968 \Device\Harddisk0\DR0\Partition1 - ok 08:50:38.0796 0968 ============================================================ 08:50:38.0796 0968 Scan finished 08:50:38.0796 0968 ============================================================ 08:50:38.0796 3704 Detected object count: 0 08:50:38.0796 3704 Actual detected object count: 0

Here's the combo fix - kind of scary - Hope system still functions

ComboFix 12-10-26.05 - John Conway 10/28/2012 13:04:42.5.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3070.2337 [GMT -4:00]
Running from: c:\download\Hijack\Combo fix\ComboFix.exe
AV: Norton Security Suite *Disabled/Updated* {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Security Suite *Disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\SPL1F.tmp
c:\documents and settings\All Users\SPL23.tmp
c:\documents and settings\All Users\SPLA3.tmp
c:\documents and settings\All Users\SPLDF.tmp
c:\documents and settings\John Conway\GoToAssistDownloadHelper.exe
c:\documents and settings\John Conway\Recent\Kia Motors America Home.url
c:\documents and settings\John Conway\WINDOWS
c:\windows\system32\SET5D.tmp
c:\windows\system32\SET5E.tmp
c:\windows\system32\SET9D.tmp
c:\windows\system32\SETA9.tmp
c:\windows\system32\SETB1.tmp
c:\windows\system32\SETB2.tmp
c:\windows\system32\SETB4.tmp
c:\windows\system32\SETB7.tmp
c:\windows\system32\URTTemp
c:\windows\system32\URTTemp\fusion.dll
c:\windows\system32\URTTemp\mscoree.dll
c:\windows\system32\URTTemp\mscoree.dll.local
c:\windows\system32\URTTemp\mscorsn.dll
c:\windows\system32\URTTemp\mscorwks.dll
c:\windows\system32\URTTemp\msvcr71.dll
c:\windows\system32\URTTemp\regtlib.exe
c:\windows\wt
c:\windows\wt\data.wts
c:\windows\wt\updater\wt.ini
c:\windows\wt\webdriver.dll
c:\windows\wt\webdriver\4.1.1\actorobject.dll
c:\windows\wt\webdriver\4.1.1\dx5drv.dll
c:\windows\wt\webdriver\4.1.1\dx7drv.dll
c:\windows\wt\webdriver\4.1.1\objectbundle.dll
c:\windows\wt\webdriver\4.1.1\sound.dll
c:\windows\wt\webdriver\4.1.1\wdcaps.ded
c:\windows\wt\webdriver\4.1.1\wdengine.dll
c:\windows\wt\webdriver\4.1.1\webdriver.dll
c:\windows\wt\webdriver\4.1.1\wthost.exe
c:\windows\wt\webdriver\4.1.1\wthostctl.dll
c:\windows\wt\webdriver\4.1.1\wtmulti.dll
c:\windows\wt\webdriver\4.1.1\wtmulti.jar
c:\windows\wt\webdriver\4.1.1\wtwmplug.ax
c:\windows\wt\webdriver\4.1.1\wtwmplug.ini
c:\windows\wt\webdriver\jdriver.dll
c:\windows\wt\webdriver\rdriver.dll
c:\windows\wt\webdriver\wildtangent.jar
c:\windows\wt\wt3d.dll
c:\windows\wt\wt3d.ini
c:\windows\wt\wtupdates\DRM\3.2.0.19\files\controlpanel\index.html
c:\windows\wt\wtupdates\DRM\3.2.0.19\files\DRM0302.dll
c:\windows\wt\wtupdates\DRM\3.2.0.19\files\DRM0302Java.jar
c:\windows\wt\wtupdates\DRM\3.2.0.19\files\jDRM0302.dll
c:\windows\wt\wtupdates\DRM\3.2.0.19\files\rDRM0302.dll
c:\windows\wt\wtupdates\DRM\3.2.0.19\install\DRM0302.cdanfo
c:\windows\wt\wtupdates\DRM\3.2.0.19\install\DRM0302_Uninstall.cdas
c:\windows\wt\wtupdates\webd\4.1.1\files\actorobject.dll
c:\windows\wt\wtupdates\webd\4.1.1\files\controlpanel\index.html
c:\windows\wt\wtupdates\webd\4.1.1\files\dx5drv.dll
c:\windows\wt\wtupdates\webd\4.1.1\files\dx7drv.dll
c:\windows\wt\wtupdates\webd\4.1.1\files\jdriver.dll
c:\windows\wt\wtupdates\webd\4.1.1\files\legacy\data.wts
c:\windows\wt\wtupdates\webd\4.1.1\files\legacy\webdriver.dll
c:\windows\wt\wtupdates\webd\4.1.1\files\legacy\wt3d.dll
c:\windows\wt\wtupdates\webd\4.1.1\files\npWTHost.dll
c:\windows\wt\wtupdates\webd\4.1.1\files\nsIWTHostPlugin.xpt
c:\windows\wt\wtupdates\webd\4.1.1\files\ObjectBundle.dll
c:\windows\wt\wtupdates\webd\4.1.1\files\rdriver.dll
c:\windows\wt\wtupdates\webd\4.1.1\files\Sound.dll
c:\windows\wt\wtupdates\webd\4.1.1\files\update_info\data.wts
c:\windows\wt\wtupdates\webd\4.1.1\files\wdcaps.ded
c:\windows\wt\wtupdates\webd\4.1.1\files\wdengine.dll
c:\windows\wt\wtupdates\webd\4.1.1\files\Webd331.cdanfo
c:\windows\wt\wtupdates\webd\4.1.1\files\Webd331_fileList.cdas
c:\windows\wt\wtupdates\webd\4.1.1\files\Webd331_Uninstall.cdas
c:\windows\wt\wtupdates\webd\4.1.1\files\webdriver.dll
c:\windows\wt\wtupdates\webd\4.1.1\files\wildtangent.jar
c:\windows\wt\wtupdates\webd\4.1.1\files\wt3d.ini
c:\windows\wt\wtupdates\webd\4.1.1\files\WTHost.exe
c:\windows\wt\wtupdates\webd\4.1.1\files\WTHostCtl.dll
c:\windows\wt\wtupdates\webd\4.1.1\files\wtmulti.dll
c:\windows\wt\wtupdates\webd\4.1.1\files\wtmulti.jar
c:\windows\wt\wtupdates\webd\4.1.1\files\wtvh.dll
c:\windows\wt\wtupdates\webd\4.1.1\files\wtwmplug.ax
c:\windows\wt\wtupdates\webd\4.1.1\files\wtwmplug.ini
c:\windows\wt\wtupdates\webd\4.1.1\install\Webd4_1_1.cdanfo
c:\windows\wt\wtupdates\webd\4.1.1\install\Webd4_1_1_Uninstall.cdas
c:\windows\wt\wtupdates\WireControl\1.0.0.63\files\controlpanel\index.html
c:\windows\wt\wtupdates\WireControl\1.0.0.63\files\install\WireControl.cdanfo
c:\windows\wt\wtupdates\WireControl\1.0.0.63\files\install\WireControl_Uninstall.cdas
c:\windows\wt\wtupdates\WireControl\1.0.0.63\files\WireControl.dll
c:\windows\wt\wtupdates\wtupdater\appinfo.dat
c:\windows\wt\wtupdates\wtwebdriver\update_info\data.wts
c:\windows\wt\wtvh.dll
.
.
((((((((((((((((((((((((( Files Created from 2012-09-28 to 2012-10-28 )))))))))))))))))))))))))))))))
.
.
2012-10-27 18:04 . 2012-10-27 18:04 388096 —-a-r- c:\documents and settings\John Conway\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2012-10-12 20:07 . 2012-10-12 20:07 ——– d—–w- c:\windows\_ISTMP2.DIR
2012-10-09 19:03 . 2012-10-10 11:25 ——– d—–w- c:\windows\system32\drivers\N360\0604000.009
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-10-27 19:10 . 2012-04-04 11:59 696760 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-10-27 19:10 . 2011-05-17 10:33 73656 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-08-28 15:14 . 2005-08-16 10:18 916992 —-a-w- c:\windows\system32\wininet.dll
2012-08-28 15:14 . 2005-08-16 10:18 43520 ——w- c:\windows\system32\licmgr10.dll
2012-08-28 15:14 . 2005-08-16 10:18 1469440 ——w- c:\windows\system32\inetcpl.cpl
2012-08-28 12:07 . 2005-08-16 10:18 385024 ——w- c:\windows\system32\html.iec
2012-08-24 13:53 . 2005-08-16 10:18 177664 —-a-w- c:\windows\system32\wintrust.dll
2012-08-21 13:33 . 2005-08-16 10:18 2148864 —-a-w- c:\windows\system32\ntoskrnl.exe
2012-08-21 12:58 . 2004-08-04 04:59 2027520 —-a-w- c:\windows\system32\ntkrnlpa.exe
.
.
((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-10-20 02:46 . 2012-10-20 02:46 430080 c:\documents and settings\John Conway\Application Data\ArcSoft\Rocket Data\bak\bak_2012_10_19.db
.
2012-10-23 16:27 . 2012-10-23 16:27 471040 c:\documents and settings\John Conway\Application Data\ArcSoft\Rocket Data\bak\bak_2012_10_23.db
.
2012-10-28 01:05 . 2012-10-23 16:27 471040 c:\documents and settings\John Conway\Application Data\ArcSoft\Rocket Data\bak\bak_2012_10_27.db
.
2012-07-26 01:05 . 2012-07-07 19:30 425984 c:\documents and settings\John Conway\Application Data\ArcSoft\Rocket Data\bak\bak_2012_7_25.db
.
2012-07-07 01:19 . 2012-07-07 01:10 425984 c:\documents and settings\John Conway\Application Data\ArcSoft\Rocket Data\bak\bak_2012_7_6.db
.
2012-07-07 19:45 . 2012-07-07 19:30 425984 c:\documents and settings\John Conway\Application Data\ArcSoft\Rocket Data\bak\bak_2012_7_7.db
.
2012-09-15 02:54 . 2012-09-15 02:54 430080 c:\documents and settings\John Conway\Application Data\ArcSoft\Rocket Data\bak\bak_2012_9_14.db
.
2006-03-30 20:45 . 2006-03-30 20:45 313472 c:\program files\Adobe\Acrobat 7.0\Reader\bak\AdobeUpdateManager.exe
.
2006-03-10 23:01 . 2005-08-06 03:05 344064 c:\program files\ATI Technologies\ATI Control Panel\bak\atiptaxx.exe
.
2005-06-10 16:44 . 2005-06-10 16:44 81920 c:\program files\Common Files\InstallShield\UpdateService\bak\issch.exe
.
2005-06-10 16:44 . 2005-06-10 16:44 249856 c:\program files\Common Files\InstallShield\UpdateService\bak\isuspm.exe
.
2006-08-10 14:09 . 2006-08-10 14:09 180269 c:\program files\Common Files\Real\Update_OB\bak\realsched.exe
.
2005-10-05 09:12 . 2006-05-03 07:12 98304 c:\program files\Dell\Media Experience\bak\DMXLauncher.exe
.
2006-03-10 23:13 . 2007-07-20 12:43 1836544 c:\program files\Google\Google Desktop Search\bak\GoogleDesktop.exe
.
2007-08-04 12:00 . 2007-07-12 08:00 132496 c:\program files\Java\jre1.6.0_02\bin\bak\jusched.exe
.
2005-03-23 23:26 . 2005-03-23 23:26 217088 c:\program files\Microsoft IntelliPoint\bak\point32.exe
2005-03-23 23:26 . 2005-03-23 23:26 217088 c:\program files\Microsoft IntelliPoint\point32.exe
.
2006-03-10 23:07 . 2005-09-09 01:20 8192 c:\program files\MUSICMATCH\Musicmatch Jukebox\bak\mimboot.exe
.
2006-03-10 23:04 . 2006-03-10 23:04 98304 c:\program files\QuickTime\bak\bak\qttask.exe
2012-04-19 00:56 . 2012-04-19 00:56 421888 c:\program files\QuickTime\QTTask.exe
.
2006-03-10 23:04 . 2006-03-10 23:04 98304 c:\program files\QuickTime\bak\bak\qttask.exe
.
2005-08-16 10:40 . 2005-09-27 00:34 169984 c:\windows\pchealth\helpctr\binaries\bak\MSConfig.exe
2005-08-16 10:40 . 2008-04-14 00:12 169984 c:\windows\pchealth\helpctr\binaries\msconfig.exe
.
2005-08-16 10:18 . 2004-08-10 11:00 15360 c:\windows\system32\bak\ctfmon.exe
2005-08-16 10:18 . 2008-04-14 00:12 15360 c:\windows\system32\ctfmon.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [N/A]
"KGShareApp"="c:\program files\Kodak\KODAK Share Button App\KGShare_App.exe" [2012-02-03 394752]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"lxdfamon"="c:\program files\Lexmark 6500 Series\lxdfamon.exe" [2007-06-01 20480]
"Lexmark 6500 Series Fax Server"="c:\program files\Lexmark 6500 Series\fm3032.exe" [2007-06-11 308144]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\point32.exe" [2005-03-23 217088]
"lxdfmon.exe"="c:\program files\Lexmark 6500 Series\lxdfmon.exe" [2007-06-11 455600]
"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-27 207424]
"ArcSoft MediaImpression Monitor"="c:\program files\Kodak\MediaImpression\ArcMonitor.exe" [2010-12-15 80448]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2012-04-19 421888]
"KodakShareButtonApp"="c:\program files\Kodak\KODAK Share Button App\Listener.exe" [2012-02-03 108032]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Exif Launcher S.lnk - c:\program files\FinePixViewerS\QuickDCF2.exe [2012-4-8 303104]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2007-09-28 15:36 10792 —-a-w- c:\program files\Citrix\GoToAssist\480\g2awinlogon.dll
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Exif Launcher S.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Exif Launcher S.lnk
backup=c:\windows\pss\Exif Launcher S.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Find Fast.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Find Fast.lnk
backup=c:\windows\pss\Microsoft Find Fast.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Office Startup.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Office Startup.lnk
backup=c:\windows\pss\Office Startup.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMXLauncher]
c:\program files\Dell\Media Experience\DMXLauncher.exe [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
2004-08-10 08:04 59392 —-a-w- c:\windows\ehome\ehtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
c:\program files\Common Files\InstallShield\UpdateService\issch.exe [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mcagent_exe]
c:\program files\McAfee.com\Agent\mcagent.exe [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MimBoot]
c:\progra~1\MUSICM~1\MUSICM~3\mimboot.exe [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\openvpn-gui]
2006-04-06 22:39 99328 —-a-w- c:\download\OpenVPN\bin\openvpn-gui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2012-04-19 00:56 421888 —-a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]
2005-03-23 05:20 339968 —-a-w- c:\windows\stsystra.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
c:\program files\Steam\Steam.exe [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
c:\program files\Java\jre1.6.0_02\bin\jusched.exe [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
c:\program files\Common Files\Real\Update_OB\realsched.exe [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Lexmark 6500 Series\\lxdfmon.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdfpswx.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdftime.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdfjswx.exe"=
"c:\\Program Files\\Lexmark 6500 Series\\Wireless\\lxdfwpss.exe"=
"c:\\WINDOWS\\system32\\lxdfcfg.exe"=
"c:\\WINDOWS\\system32\\lxdfcoms.exe"=
"c:\\Program Files\\Lexmark 6500 Series\\lxdfamon.exe"=
"c:\\Program Files\\Lexmark 6500 Series\\FRun.exe"=
"c:\\Program Files\\Abbyy FineReader 6.0 Sprint\\scan\\scanman6.exe"=
"c:\\Program Files\\Lexmark 6500 Series\\lxdffax.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:UDP"= 5353:UDP:Bonjour Port 5353
.
R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\N360\0604000.009\symds.sys [10/9/2012 3:04 PM 340088]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360\0604000.009\symefa.sys [10/9/2012 3:04 PM 924320]
R1 BHDrvx86;BHDrvx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\Definitions\BASHDefs\20121005.002\BHDrvx86.sys [10/5/2012 2:23 PM 995488]
R1 ccSet_N360;Norton Security Suite Settings Manager;c:\windows\system32\drivers\N360\0604000.009\ccsetx86.sys [10/9/2012 3:04 PM 132768]
R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\N360\0604000.009\ironx86.sys [10/9/2012 3:04 PM 149624]
R2 IntuitUpdateServiceV4;Intuit Update Service v4;c:\program files\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe [8/25/2011 6:53 PM 13672]
R2 lxdf_device;lxdf_device;c:\windows\system32\lxdfcoms.exe -service –> c:\windows\system32\lxdfcoms.exe -service [?]
R2 N360;Norton Security Suite;c:\program files\Norton Security Suite\Engine\6.4.0.9\ccsvchst.exe [10/9/2012 3:03 PM 138272]
R3 ArcCD;ArcCD Filter Driver Service;c:\windows\system32\drivers\ArcCD.sys [12/26/2010 5:08 PM 36224]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [8/9/2012 2:55 PM 106656]
R3 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\Definitions\IPSDefs\20121027.001\IDSXpx86.sys [10/27/2012 7:14 AM 373728]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [8/20/2009 10:45 AM 133104]
S2 lxdfCATSCustConnectService;lxdfCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxdfserv.exe [3/13/2008 12:35 PM 99248]
S2 ptssvc;ptssvc;c:\program files\KODAK\KODAK Picture Transfer Software\PTSsvc.exe –> c:\program files\KODAK\KODAK Picture Transfer Software\PTSsvc.exe [?]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [4/4/2012 7:59 AM 250808]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [8/20/2009 10:45 AM 133104]
S3 MatSvc;Microsoft Automated Troubleshooting Service;c:\program files\Microsoft Fix it Center\Matsvc.exe [6/13/2011 10:09 PM 267568]
S3 tap0801;TAP-Win32 Adapter V8;c:\windows\system32\drivers\tap0801.sys [4/6/2006 6:39 PM 23552]
S4 ArcUdfs;ArcUdfs FileSystem Driver Service;c:\windows\system32\drivers\ArcUdfs.sys [12/26/2010 5:08 PM 134912]
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - 22516649
*NewlyCreated* - 25728031
*NewlyCreated* - 72293284
*Deregistered* - 22516649
*Deregistered* - 25728031
*Deregistered* - 72293284
*Deregistered* - ArcRec
.
Contents of the 'Scheduled Tasks' folder
.
2012-10-28 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-04 19:10]
.
2012-10-25 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 21:57]
.
2012-10-28 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-20 14:45]
.
2012-10-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-20 14:45]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.comcast.net/a
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
IE: &Google Search - c:\program files\google\GoogleToolbar2.dll/cmsearch.html
IE: &Translate English Word - c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
IE: Backward Links - c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
IE: Cached Snapshot of Page - c:\program files\google\GoogleToolbar2.dll/cmcache.html
IE: Similar Pages - c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
IE: Translate Page into English - c:\program files\google\GoogleToolbar2.dll/cmtrans.html
Trusted Zone: intuit.com\ttlc
Trusted Zone: turbotax.com
TCP: DhcpNameServer = 75.75.75.75 75.75.76.76
.
- - - - ORPHANS REMOVED - - - -
.
SafeBoot-mcmscsvc
SafeBoot-MCODS
AddRemove-WebCyberCoach_wtrb - c:\program files\WebCyberCoach\b_Dell\WCC_Wipe.exe WebCyberCoach ext\wtrb
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-10-28 13:10
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\N360]
"ImagePath"="\"c:\program files\Norton Security Suite\Engine\6.4.0.9\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files\Norton Security Suite\Engine\6.4.0.9\diMaster.dll\" /prefetch:1"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\S-1-5-21-3219296993-1097965439-1304914948-1005\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(920)
c:\program files\Citrix\GoToAssist\480\G2AWinLogon.dll
.
Completion time: 2012-10-28 13:13:14
ComboFix-quarantined-files.txt 2012-10-28 17:13
ComboFix2.txt 2009-01-19 15:53
.
Pre-Run: 116,162,916,352 bytes free
Post-Run: 116,425,330,688 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect
.
- - End Of File - - 7CCC708B3CD2066D819EFD2039E7E296

results of combofix. was worried that the file changes didn't apply but see that they.

Onward and upward
ComboFix 12-10-26.05 - John Conway 10/28/2012 14:36:41.6.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3070.2412 [GMT -4:00]
Running from: c:\download\Hijack\Combofix\ComboFix.exe
Command switches used :: c:\download\Hijack\Combofix\CFScript.txt
AV: Norton Security Suite *Disabled/Updated* {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Security Suite *Disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
.
FILE ::
"c:\documents and settings\John Conway\Application Data\ArcSoft\Rocket Data\bak\bak_2012_10_19.db"
"c:\documents and settings\John Conway\Application Data\ArcSoft\Rocket Data\bak\bak_2012_10_23.db"
"c:\documents and settings\John Conway\Application Data\ArcSoft\Rocket Data\bak\bak_2012_10_27.db"
"c:\documents and settings\John Conway\Application Data\ArcSoft\Rocket Data\bak\bak_2012_7_25.db"
"c:\documents and settings\John Conway\Application Data\ArcSoft\Rocket Data\bak\bak_2012_7_6.db"
"c:\documents and settings\John Conway\Application Data\ArcSoft\Rocket Data\bak\bak_2012_7_7.db"
"c:\documents and settings\John Conway\Application Data\ArcSoft\Rocket Data\bak\bak_2012_9_14.db"
"c:\program files\Adobe\Acrobat 7.0\Reader\bak\AdobeUpdateManager.exe"
"c:\program files\ATI Technologies\ATI Control Panel\bak\atiptaxx.exe"
"c:\program files\Common Files\InstallShield\UpdateService\bak\issch.exe"
"c:\program files\Dell\Media Experience\bak\DMXLauncher.exe"
"c:\program files\Google\Google Desktop Search\bak\GoogleDesktop.exe"
"c:\program files\Microsoft IntelliPoint\bak\point32.exe"
"c:\program files\MUSICMATCH\Musicmatch Jukebox\bak\mimboot.exe"
"c:\program files\QuickTime\bak\bak\qttask.exe"
.
.
((((((((((((((((((((((((( Files Created from 2012-09-28 to 2012-10-28 )))))))))))))))))))))))))))))))
.
.
2012-10-27 18:04 . 2012-10-27 18:04 388096 —-a-r- c:\documents and settings\John Conway\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2012-10-12 20:07 . 2012-10-12 20:07 ——– d—–w- c:\windows\_ISTMP2.DIR
2012-10-09 19:03 . 2012-10-10 11:25 ——– d—–w- c:\windows\system32\drivers\N360\0604000.009
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-10-27 19:10 . 2012-04-04 11:59 696760 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-10-27 19:10 . 2011-05-17 10:33 73656 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-08-28 15:14 . 2005-08-16 10:18 916992 —-a-w- c:\windows\system32\wininet.dll
2012-08-28 15:14 . 2005-08-16 10:18 43520 ——w- c:\windows\system32\licmgr10.dll
2012-08-28 15:14 . 2005-08-16 10:18 1469440 ——w- c:\windows\system32\inetcpl.cpl
2012-08-28 12:07 . 2005-08-16 10:18 385024 ——w- c:\windows\system32\html.iec
2012-08-24 13:53 . 2005-08-16 10:18 177664 —-a-w- c:\windows\system32\wintrust.dll
2012-08-21 13:33 . 2005-08-16 10:18 2148864 —-a-w- c:\windows\system32\ntoskrnl.exe
2012-08-21 12:58 . 2004-08-04 04:59 2027520 —-a-w- c:\windows\system32\ntkrnlpa.exe
.
.
((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-10-20 02:46 . 2012-10-20 02:46 430080 c:\documents and settings\John Conway\Application Data\ArcSoft\Rocket Data\bak\bak_2012_10_19.db
.
2012-10-23 16:27 . 2012-10-23 16:27 471040 c:\documents and settings\John Conway\Application Data\ArcSoft\Rocket Data\bak\bak_2012_10_23.db
.
2012-10-28 01:05 . 2012-10-23 16:27 471040 c:\documents and settings\John Conway\Application Data\ArcSoft\Rocket Data\bak\bak_2012_10_27.db
.
2012-07-26 01:05 . 2012-07-07 19:30 425984 c:\documents and settings\John Conway\Application Data\ArcSoft\Rocket Data\bak\bak_2012_7_25.db
.
2012-07-07 01:19 . 2012-07-07 01:10 425984 c:\documents and settings\John Conway\Application Data\ArcSoft\Rocket Data\bak\bak_2012_7_6.db
.
2012-07-07 19:45 . 2012-07-07 19:30 425984 c:\documents and settings\John Conway\Application Data\ArcSoft\Rocket Data\bak\bak_2012_7_7.db
.
2012-09-15 02:54 . 2012-09-15 02:54 430080 c:\documents and settings\John Conway\Application Data\ArcSoft\Rocket Data\bak\bak_2012_9_14.db
.
2006-03-30 20:45 . 2006-03-30 20:45 313472 c:\program files\Adobe\Acrobat 7.0\Reader\bak\AdobeUpdateManager.exe
.
2006-03-10 23:01 . 2005-08-06 03:05 344064 c:\program files\ATI Technologies\ATI Control Panel\bak\atiptaxx.exe
.
2005-06-10 16:44 . 2005-06-10 16:44 81920 c:\program files\Common Files\InstallShield\UpdateService\bak\issch.exe
.
2005-06-10 16:44 . 2005-06-10 16:44 249856 c:\program files\Common Files\InstallShield\UpdateService\bak\isuspm.exe
.
2006-08-10 14:09 . 2006-08-10 14:09 180269 c:\program files\Common Files\Real\Update_OB\bak\realsched.exe
.
2005-10-05 09:12 . 2006-05-03 07:12 98304 c:\program files\Dell\Media Experience\bak\DMXLauncher.exe
.
2006-03-10 23:13 . 2007-07-20 12:43 1836544 c:\program files\Google\Google Desktop Search\bak\GoogleDesktop.exe
.
2007-08-04 12:00 . 2007-07-12 08:00 132496 c:\program files\Java\jre1.6.0_02\bin\bak\jusched.exe
.
2005-03-23 23:26 . 2005-03-23 23:26 217088 c:\program files\Microsoft IntelliPoint\bak\point32.exe
2005-03-23 23:26 . 2005-03-23 23:26 217088 c:\program files\Microsoft IntelliPoint\point32.exe
.
2006-03-10 23:07 . 2005-09-09 01:20 8192 c:\program files\MUSICMATCH\Musicmatch Jukebox\bak\mimboot.exe
.
2006-03-10 23:04 . 2006-03-10 23:04 98304 c:\program files\QuickTime\bak\bak\qttask.exe
2012-04-19 00:56 . 2012-04-19 00:56 421888 c:\program files\QuickTime\QTTask.exe
.
2006-03-10 23:04 . 2006-03-10 23:04 98304 c:\program files\QuickTime\bak\bak\qttask.exe
.
2005-08-16 10:40 . 2005-09-27 00:34 169984 c:\windows\pchealth\helpctr\binaries\bak\MSConfig.exe
2005-08-16 10:40 . 2008-04-14 00:12 169984 c:\windows\pchealth\helpctr\binaries\msconfig.exe
.
2005-08-16 10:18 . 2004-08-10 11:00 15360 c:\windows\system32\bak\ctfmon.exe
2005-08-16 10:18 . 2008-04-14 00:12 15360 c:\windows\system32\ctfmon.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [N/A]
"KGShareApp"="c:\program files\Kodak\KODAK Share Button App\KGShare_App.exe" [2012-02-03 394752]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"lxdfamon"="c:\program files\Lexmark 6500 Series\lxdfamon.exe" [2007-06-01 20480]
"Lexmark 6500 Series Fax Server"="c:\program files\Lexmark 6500 Series\fm3032.exe" [2007-06-11 308144]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\point32.exe" [2005-03-23 217088]
"lxdfmon.exe"="c:\program files\Lexmark 6500 Series\lxdfmon.exe" [2007-06-11 455600]
"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-27 207424]
"ArcSoft MediaImpression Monitor"="c:\program files\Kodak\MediaImpression\ArcMonitor.exe" [2010-12-15 80448]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2012-04-19 421888]
"KodakShareButtonApp"="c:\program files\Kodak\KODAK Share Button App\Listener.exe" [2012-02-03 108032]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Exif Launcher S.lnk - c:\program files\FinePixViewerS\QuickDCF2.exe [2012-4-8 303104]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2007-09-28 15:36 10792 —-a-w- c:\program files\Citrix\GoToAssist\480\g2awinlogon.dll
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Exif Launcher S.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Exif Launcher S.lnk
backup=c:\windows\pss\Exif Launcher S.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Find Fast.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Find Fast.lnk
backup=c:\windows\pss\Microsoft Find Fast.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Office Startup.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Office Startup.lnk
backup=c:\windows\pss\Office Startup.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMXLauncher]
c:\program files\Dell\Media Experience\DMXLauncher.exe [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
2004-08-10 08:04 59392 —-a-w- c:\windows\ehome\ehtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
c:\program files\Common Files\InstallShield\UpdateService\issch.exe [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mcagent_exe]
c:\program files\McAfee.com\Agent\mcagent.exe [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MimBoot]
c:\progra~1\MUSICM~1\MUSICM~3\mimboot.exe [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\openvpn-gui]
2006-04-06 22:39 99328 —-a-w- c:\download\OpenVPN\bin\openvpn-gui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2012-04-19 00:56 421888 —-a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]
2005-03-23 05:20 339968 —-a-w- c:\windows\stsystra.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
c:\program files\Steam\Steam.exe [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
c:\program files\Java\jre1.6.0_02\bin\jusched.exe [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
c:\program files\Common Files\Real\Update_OB\realsched.exe [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Lexmark 6500 Series\\lxdfmon.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdfpswx.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdftime.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdfjswx.exe"=
"c:\\Program Files\\Lexmark 6500 Series\\Wireless\\lxdfwpss.exe"=
"c:\\WINDOWS\\system32\\lxdfcfg.exe"=
"c:\\WINDOWS\\system32\\lxdfcoms.exe"=
"c:\\Program Files\\Lexmark 6500 Series\\lxdfamon.exe"=
"c:\\Program Files\\Lexmark 6500 Series\\FRun.exe"=
"c:\\Program Files\\Abbyy FineReader 6.0 Sprint\\scan\\scanman6.exe"=
"c:\\Program Files\\Lexmark 6500 Series\\lxdffax.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:UDP"= 5353:UDP:Bonjour Port 5353
.
R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\N360\0604000.009\symds.sys [10/9/2012 3:04 PM 340088]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360\0604000.009\symefa.sys [10/9/2012 3:04 PM 924320]
R1 BHDrvx86;BHDrvx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\Definitions\BASHDefs\20121005.002\BHDrvx86.sys [10/5/2012 2:23 PM 995488]
R1 ccSet_N360;Norton Security Suite Settings Manager;c:\windows\system32\drivers\N360\0604000.009\ccsetx86.sys [10/9/2012 3:04 PM 132768]
R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\N360\0604000.009\ironx86.sys [10/9/2012 3:04 PM 149624]
R2 IntuitUpdateServiceV4;Intuit Update Service v4;c:\program files\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe [8/25/2011 6:53 PM 13672]
R2 lxdf_device;lxdf_device;c:\windows\system32\lxdfcoms.exe -service –> c:\windows\system32\lxdfcoms.exe -service [?]
R2 N360;Norton Security Suite;c:\program files\Norton Security Suite\Engine\6.4.0.9\ccsvchst.exe [10/9/2012 3:03 PM 138272]
R3 ArcCD;ArcCD Filter Driver Service;c:\windows\system32\drivers\ArcCD.sys [12/26/2010 5:08 PM 36224]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [8/9/2012 2:55 PM 106656]
R3 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\Definitions\IPSDefs\20121027.001\IDSXpx86.sys [10/27/2012 7:14 AM 373728]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [8/20/2009 10:45 AM 133104]
S2 lxdfCATSCustConnectService;lxdfCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxdfserv.exe [3/13/2008 12:35 PM 99248]
S2 ptssvc;ptssvc;c:\program files\KODAK\KODAK Picture Transfer Software\PTSsvc.exe –> c:\program files\KODAK\KODAK Picture Transfer Software\PTSsvc.exe [?]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [4/4/2012 7:59 AM 250808]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [8/20/2009 10:45 AM 133104]
S3 MatSvc;Microsoft Automated Troubleshooting Service;c:\program files\Microsoft Fix it Center\Matsvc.exe [6/13/2011 10:09 PM 267568]
S3 tap0801;TAP-Win32 Adapter V8;c:\windows\system32\drivers\tap0801.sys [4/6/2006 6:39 PM 23552]
S4 ArcUdfs;ArcUdfs FileSystem Driver Service;c:\windows\system32\drivers\ArcUdfs.sys [12/26/2010 5:08 PM 134912]
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - 22516649
*NewlyCreated* - 25728031
*NewlyCreated* - 72293284
*Deregistered* - 22516649
*Deregistered* - 25728031
*Deregistered* - 72293284
*Deregistered* - ArcRec
.
Contents of the 'Scheduled Tasks' folder
.
2012-10-28 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-04 19:10]
.
2012-10-25 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 21:57]
.
2012-10-28 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-20 14:45]
.
2012-10-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-20 14:45]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.comcast.net/a
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
IE: &Google Search - c:\program files\google\GoogleToolbar2.dll/cmsearch.html
IE: &Translate English Word - c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
IE: Backward Links - c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
IE: Cached Snapshot of Page - c:\program files\google\GoogleToolbar2.dll/cmcache.html
IE: Similar Pages - c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
IE: Translate Page into English - c:\program files\google\GoogleToolbar2.dll/cmtrans.html
Trusted Zone: intuit.com\ttlc
Trusted Zone: turbotax.com
TCP: DhcpNameServer = 75.75.75.75 75.75.76.76
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-10-28 14:41
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\N360]
"ImagePath"="\"c:\program files\Norton Security Suite\Engine\6.4.0.9\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files\Norton Security Suite\Engine\6.4.0.9\diMaster.dll\" /prefetch:1"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\S-1-5-21-3219296993-1097965439-1304914948-1005\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(920)
c:\program files\Citrix\GoToAssist\480\G2AWinLogon.dll
.
- - - - - - - > 'explorer.exe'(2424)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2012-10-28 14:43:34
ComboFix-quarantined-files.txt 2012-10-28 18:43
ComboFix2.txt 2012-10-28 17:13
ComboFix3.txt 2009-01-19 15:53
.
Pre-Run: 116,430,233,600 bytes free
Post-Run: 116,463,132,672 bytes free
.
- - End Of File - - 4DC6538C41964658AF7110D26DC3F2EF