[Resolved] Live Safety Center and Online Security Guide icons on

I have found another person with the same issues as I have: Posted 11/11/07 and BRAIN 26 helped.

a yellow flashing triangle in the bottom right corner and Live Safety Center and Online Security Guide icons on the desktop. ever since then i have been getting these pop ups saying i have spyware and that i should download anti virus software and i get sum pop ups from savetheinformation.com, system alert: trojan-spy.win32 and stuff lyk that. I got these after I tried to upgrade internet explorer this weekend.

I have also scanned my computer and did this in safe mode too, did not help. Will the same fixes that worked for this one work for me? I already have ATF cleaner and combo-fix downloaded.

Here is my log

Logfile of HijackThis v1.99.1
Scan saved at 8:18:03 PM, on 11/15/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Norton SystemWorks Basic Edition\Norton GoBack\GBPoll.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\Norton SystemWorks Basic Edition\Norton GoBack\GBTray.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\PROGRA~1\SPYWAR~1\swdoctor.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\Norton SystemWorks Basic Edition\Norton GoBack\GBTray.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis\HijackThis.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://home.peoplepc.com/search
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0.dll
O3 - Toolbar: PeoplePal Toolbar - {A8FB8EB3-183B-4598-924D-86F0E5E37085} - c:\program files\peoplepc\toolbar\PPCToolbar.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINDOWS\system32\xvguuluh.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [08931858] rundll32.exe "C:\WINDOWS\system32\rrdmculj.dll",b
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Spyware Doctor] C:\PROGRA~1\SPYWAR~1\swdoctor.exe /Q
O4 - HKCU\..\Run: [RealPlayer] "C:\Program Files\Real\RealPlayer\realplay.exe" /RunUPGToolCommandReBoot
O4 - Startup: Norton Internet Security.lnk = ?
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Norton GoBack.lnk = C:\Program Files\Norton SystemWorks Basic Edition\Norton GoBack\GBTray.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll
O9 - Extra button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Basic Edition\Norton Cleanup\WCQuick.lnk
O9 - Extra 'Tools' menuitem: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Basic Edition\Norton Cleanup\WCQuick.lnk
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/02ab3c755b7290…ip/RdxIE601.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://scan.safety.live.com/resource/downl…lscbase7617.cab
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1122233795328
O16 - DPF: {74C861A1-D548-4916-BC8A-FDE92EDFF62C} - http://mediaplayer.walmart.com/installer/install.cab
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/…/ymmapi_416.dll
O23 - Service: AOL Instant Messenger (AOL Instant Messenger) - Unknown owner - C:\WINDOWS\msnmsgr.exe (file missing)
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h cltCommon (file missing)
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: GoBack Polling Service (GBPoll) - Symantec Corporation - C:\Program Files\Norton SystemWorks Basic Edition\Norton GoBack\GBPoll.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

LDTate:

Thanks for the fast response: I just don't know enough about registry's to attempt a fix. In the wait I have had the computer freeze and not show desktop icons, I was able to re-boot in Safe-Mode and have used spybot S&D. The errors are less each time but virtumonde keeps appearing. IE has not worked since I upgraded to 7, since this time I have been using Firfox (I think Firefox is better).

Here is the combo fix log:

ComboFix 07-11-08.1 - customer 2007-11-16 19:12:45.2 - NTFSx86
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
.

Unable to gain System Privileges

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Start Menu\Live Safety Center.lnk
C:\Documents and Settings\All Users\Start Menu\Online Security Guide.lnk
C:\Documents and Settings\customer\Desktop\Live Safety Center.lnk
C:\Documents and Settings\customer\Desktop\Online Security Guide.lnk
C:\Documents and Settings\customer\Favorites\Online Security Guide.lnk
C:\Documents and Settings\Janice\Desktop\Live Safety Center.lnk
C:\Documents and Settings\Janice\Desktop\Online Security Guide.lnk
C:\Documents and Settings\Janice\Favorites\Online Security Guide.lnk
C:\WINDOWS\system32\ddcyx.dll
C:\WINDOWS\system32\xvguuluh.dllbox
C:\WINDOWS\system32\xycdd.ini
C:\WINDOWS\system32\xycdd.ini2

.
((((((((((((((((((((((((( Files Created from 2007-10-17 to 2007-11-17 )))))))))))))))))))))))))))))))
.

2007-11-15 20:28 79,936 –a—— C:\WINDOWS\system32\igxnyqlo.dll
2007-11-15 20:09 79,936 –a—— C:\WINDOWS\system32\qdtycgxk.dll
2007-11-13 22:31 51,200 –a—— C:\WINDOWS\NirCmd.exe
2007-11-13 20:22 d——– C:\Program Files\RegCure
2007-11-12 19:11 81,472 –a—— C:\WINDOWS\system32\rfykskue.dll
2007-11-12 19:03 145,774 –a—— C:\WINDOWS\system32\xvguuluh.dll
2007-11-12 19:02 145,774 –a—— C:\WINDOWS\system32\qphcprxw.dll
2007-10-30 19:55 625,032 –a—— C:\WINDOWS\system32\SymNeti.dll
2007-10-30 19:55 242,056 –a—— C:\WINDOWS\system32\SymRedir.dll
2007-10-30 19:55 191,536 –a—— C:\WINDOWS\system32\drivers\symtdi.sys
2007-10-30 19:55 145,968 –a—— C:\WINDOWS\system32\drivers\symfw.sys
2007-10-30 19:55 39,856 –a—— C:\WINDOWS\system32\drivers\symids.sys
2007-10-30 19:55 37,936 –a—— C:\WINDOWS\system32\drivers\symndisv.sys
2007-10-30 19:55 35,120 –a—— C:\WINDOWS\system32\drivers\symndis.sys
2007-10-30 19:55 27,696 –a—— C:\WINDOWS\system32\drivers\symredrv.sys
2007-10-30 19:55 12,848 –a—— C:\WINDOWS\system32\drivers\symdns.sys
2007-10-30 16:15 429 –a—— C:\WINDOWS\C3DPREFS.DAT
2007-10-21 16:11 d——– C:\Program Files\iStar

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-16 21:36 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2007-11-16 03:44 ——— d—–w C:\Program Files\Norton Internet Security
2007-11-15 03:08 ——— d—–w C:\Documents and Settings\All Users\Application Data\Symantec
2007-11-13 02:15 ——— d—–w C:\Documents and Settings\customer\Application Data\Apple Computer
2007-11-02 23:42 805 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2007-11-02 23:42 60,800 —-a-w C:\WINDOWS\system32\S32EVNT1.DLL
2007-11-02 23:42 123,952 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2007-11-02 23:42 10,740 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2007-11-02 23:42 ——— d—–w C:\Program Files\Symantec
2007-10-31 02:24 12,963 —-a-w C:\WINDOWS\system32\drivers\SymRedir.cat
2007-10-31 02:24 1,358 —-a-w C:\WINDOWS\system32\drivers\SymRedir.inf
2007-10-04 23:42 36,352 —-a-w C:\WINDOWS\system32\yayvutr.dll
2007-09-18 20:44 10,662 —-a-w C:\WINDOWS\system32\drivers\srtspx.cat
2007-09-18 20:44 10,662 —-a-w C:\WINDOWS\system32\drivers\srtspl.cat
2007-09-18 20:44 10,658 —-a-w C:\WINDOWS\system32\drivers\srtsp.cat
2007-09-18 20:44 1,430 —-a-w C:\WINDOWS\system32\drivers\srtspl.inf
2007-09-18 20:44 1,421 —-a-w C:\WINDOWS\system32\drivers\srtspx.inf
2007-09-18 20:44 1,415 —-a-w C:\WINDOWS\system32\drivers\srtsp.inf
2007-09-18 20:43 43,696 —-a-w C:\WINDOWS\system32\drivers\srtspx.sys
2007-09-18 20:43 317,616 —-a-w C:\WINDOWS\system32\drivers\srtspl.sys
2007-09-18 20:43 278,576 —-a-w C:\WINDOWS\system32\drivers\srtsp.sys
2007-08-21 06:15 683,520 —-a-w C:\WINDOWS\system32\inetcomm.dll
2005-11-10 05:10:06 2 –shatr C:\WINDOWS\winstart.bat
.

((((((((((((((((((((((((((((( snapshot@2007-11-13_22.58.51.07 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-11-13 05:22:24 52,764 —-a-w C:\WINDOWS\system32\perfc009.dat
+ 2007-11-16 04:47:27 52,764 —-a-w C:\WINDOWS\system32\perfc009.dat
- 2007-11-13 05:22:24 380,350 —-a-w C:\WINDOWS\system32\perfh009.dat
+ 2007-11-16 04:47:27 380,350 —-a-w C:\WINDOWS\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3c48d01b-698e-4962-9f92-4e558acfc71a}]
2007-11-15 20:28 79936 –a—— C:\WINDOWS\system32\igxnyqlo.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4CB8F4B4-5F66-4D9E-BC3B-184596A58824}]
2007-10-04 16:42 36352 –a—— C:\WINDOWS\system32\yayvutr.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A8FB8EB3-183B-4598-924D-86F0E5E37085}]
2005-09-23 09:28 198656 –a—— c:\program files\peoplepc\toolbar\PPCToolbar.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A95B2816-1D7E-4561-A202-68C0DE02353A}]
2007-11-12 19:03 145774 –a—— C:\WINDOWS\system32\xvguuluh.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{A8FB8EB3-183B-4598-924D-86F0E5E37085}"= c:\program files\peoplepc\toolbar\PPCToolbar.dll [2005-09-23 09:28 198656]
"{11A69AE4-FBED-4832-A2BF-45AF82825583}"= C:\WINDOWS\system32\xvguuluh.dll [2007-11-12 19:03 145774]

[HKEY_CLASSES_ROOT\CLSID\{A8FB8EB3-183B-4598-924D-86F0E5E37085}]
[HKEY_CLASSES_ROOT\PeoplePC.Toolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{994D628D-4D22-4DB9-B6DB-F7D9F1635817}]
[HKEY_CLASSES_ROOT\PeoplePC.Toolbar]

[HKEY_CLASSES_ROOT\CLSID\{11A69AE4-FBED-4832-A2BF-45AF82825583}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{A8FB8EB3-183B-4598-924D-86F0E5E37085}"= c:\program files\peoplepc\toolbar\PPCToolbar.dll [2005-09-23 09:28 198656]

[HKEY_CLASSES_ROOT\CLSID\{A8FB8EB3-183B-4598-924D-86F0E5E37085}]
[HKEY_CLASSES_ROOT\PeoplePC.Toolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{994D628D-4D22-4DB9-B6DB-F7D9F1635817}]
[HKEY_CLASSES_ROOT\PeoplePC.Toolbar]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2004-05-02 18:35]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-12-28 15:48]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 17:20]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-09 22:59]
"osCheck"="C:\Program Files\Norton Internet Security\osCheck.exe" [2007-01-14 00:11]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 17:30]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-09 09:59]
"Spyware Doctor"="C:\PROGRA~1\SPYWAR~1\swdoctor.exe" [2006-02-06 14:40]
"RealPlayer"="C:\Program Files\Real\RealPlayer\realplay.exe" [2006-06-19 09:24]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runservices]
"Compaq32 Service Drivers"=msconfig32.exe
"MediaXPServicePack"=mxpsp.exe
"Compd Service Drivrs"=codq.exe

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"VIEW POINT DRIVERS"=phqghum.exe
"Compaq32 Service Drivers"=msconfig32.exe
"MediaXPServicePack"=mxpsp.exe
"Compd Service Drivrs"=codq.exe
"CPU Temp Control"=wuitgurd.exe
"Spyware Doctor"="C:\Program Files\Spyware Doctor\swdoctor.exe" /Q

C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\
Acrobat Distiller 5.0.lnk - C:\Program Files\Adobe\Acrobat 5.0\Distillr\acrodist.exe [2007-05-02 21:37:23]
Adobe Acrobat 5.0.lnk - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\Acrobat.exe [2007-05-02 21:36:50]
Microsoft Access.lnk - C:\WINDOWS\Installer\{00000409-78E1-11D2-B60F-006097C998E7}\accicons.exe [2004-05-01 14:29:14]
Microsoft Excel.lnk - C:\WINDOWS\Installer\{00000409-78E1-11D2-B60F-006097C998E7}\xlicons.exe [2004-05-01 14:29:14]
Microsoft FrontPage.lnk - C:\WINDOWS\Installer\{00000409-78E1-11D2-B60F-006097C998E7}\misc.exe [2004-05-01 14:29:14]
Microsoft Outlook.lnk - C:\WINDOWS\Installer\{00000409-78E1-11D2-B60F-006097C998E7}\outicon.exe [2004-05-01 14:29:14]
Microsoft PowerPoint.lnk - C:\WINDOWS\Installer\{00000409-78E1-11D2-B60F-006097C998E7}\pptico.exe [2004-05-01 14:29:14]
Microsoft Word.lnk - C:\WINDOWS\Installer\{00000409-78E1-11D2-B60F-006097C998E7}\wordicon.exe [2004-05-01 14:29:14]
MSN 8.lnk - C:\Program Files\MSN\MSNCoreFiles\msn6.exe [2004-05-06 04:23:19]
MSN Messenger 5.0.lnk - C:\WINDOWS\Installer\{ABEB838C-A1A7-4C5D-B7E1-8B4314B00527}\MsblIco.Exe [2006-04-03 15:54:21]
NeroMediaPlayer.lnk - C:\Program Files\Ahead\NeroMediaPlayer\NeroMediaPlayer.exe [2004-05-01 14:22:50]
PeoplePC Online.LNK - C:\Program Files\PeoplePC\ISP6130\Bin\PPCOLink.exe [2005-07-24 12:23:58]
RealPlayer.lnk - C:\Program Files\Real\RealPlayer\realplay.exe [2004-05-02 18:30:20]
Windows Defender.lnk - C:\Program Files\Windows Defender\MSASCui.exe [2006-11-03 17:20:12]
Windows Journal Viewer.lnk - C:\WINDOWS\Installer\{43DCF766-6838-4F9A-8C91-D92DA586DFA7}\_C68C351F090F4EF39AFB6B7B54014C9E.exe [2004-05-01 19:00:04]
Windows Messenger.lnk - C:\Program Files\Messenger\msmsgs.exe [2005-07-25 03:15:28]
Windows Movie Maker.lnk - C:\Program Files\Movie Maker\moviemk.exe [2002-12-20 12:06:00]
Yahoo! Mail.lnk - C:\WINDOWS\system32\RUNDLL32.EXE [2001-08-18 05:00:00]
Yahoo! Messenger.lnk - C:\Program Files\Yahoo!\Messenger\YPager.exe [2004-06-16 15:46:09]

C:\Documents and Settings\customer\Start Menu\Programs\Startup\
Norton Internet Security.lnk - C:\Program Files\Common Files\Symantec Shared\NMAIN.EXE [2006-07-19 10:45:14]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Acrobat Assistant.lnk - C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe [2007-05-02 21:37:28]
Norton GoBack.lnk - C:\Program Files\Norton SystemWorks Basic Edition\Norton GoBack\GBTray.exe [2006-07-19 10:45:12]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoViewOnDrive"=0 (0x0)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{4CB8F4B4-5F66-4D9E-BC3B-184596A58824}"= C:\WINDOWS\system32\yayvutr.dll [2007-10-04 16:42 36352]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\xvguuluh]
xvguuluh.dll 2007-11-12 19:03 145774 C:\WINDOWS\system32\xvguuluh.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\yayvutr]
yayvutr.dll 2007-10-04 16:42 36352 C:\WINDOWS\system32\yayvutr.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\ddcyx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Defragmentation Manager]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\DHCP Client]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NetDDEsrv]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Perfhmon]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\upnpdrv]
@="Service"

R0 BsStor;InCD Storage Helper Driver;C:\WINDOWS\system32\DRIVERS\bsstor.sys
R2 BCMNTIO;BCMNTIO;\??\C:\PROGRA~1\CheckIt\DIAGNO~1\BCMNTIO.sys
R2 BsUDF;InCD UDF Driver;C:\WINDOWS\system32\drivers\BsUDF.sys

*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder
"2007-11-17 02:36:04 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
"2007-11-13 03:00:08 C:\WINDOWS\Tasks\Norton Internet Security - Run Full System Scan - customer.job"
"2007-10-01 18:04:09 C:\WINDOWS\Tasks\Norton SystemWorks One Button Checkup.job"
"2007-11-17 02:45:43 C:\WINDOWS\Tasks\RegCure Program Check.job"
- C:\Program Files\RegCure\RegCure.exe
"2007-11-14 03:22:35 C:\WINDOWS\Tasks\RegCure.job"
- C:\Program Files\RegCure\RegCure.exe
.
**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-16 19:47:43
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\mchInjDrv]
"ImagePath"="\??\C:\DOCUME~1\customer\LOCALS~1\Temp\mc22.tmp"
.
Completion time: 2007-11-16 19:54:12 - machine was rebooted
C:\ComboFix2.txt … 2007-11-13 23:05
.
— E O F —


Here is the HiJack Log:

Logfile of HijackThis v1.99.1
Scan saved at 7:55:27 PM, on 11/16/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Norton SystemWorks Basic Edition\Norton GoBack\GBPoll.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\PROGRA~1\SPYWAR~1\swdoctor.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\Norton SystemWorks Basic Edition\Norton GoBack\GBTray.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\Program Files\Hijackthis\Scanner.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://home.peoplepc.com/search
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: {a17cfca8-55e4-29f9-2694-e896b10d84c3} - {3c48d01b-698e-4962-9f92-4e558acfc71a} - C:\WINDOWS\system32\igxnyqlo.dll
O2 - BHO: (no name) - {4CB8F4B4-5F66-4D9E-BC3B-184596A58824} - C:\WINDOWS\system32\yayvutr.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: PeoplePal Toolbar - {A8FB8EB3-183B-4598-924D-86F0E5E37085} - c:\program files\peoplepc\toolbar\PPCToolbar.dll
O2 - BHO: (no name) - {A95B2816-1D7E-4561-A202-68C0DE02353A} - C:\WINDOWS\system32\xvguuluh.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0.dll
O3 - Toolbar: PeoplePal Toolbar - {A8FB8EB3-183B-4598-924D-86F0E5E37085} - c:\program files\peoplepc\toolbar\PPCToolbar.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINDOWS\system32\xvguuluh.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Spyware Doctor] C:\PROGRA~1\SPYWAR~1\swdoctor.exe /Q
O4 - HKCU\..\Run: [RealPlayer] "C:\Program Files\Real\RealPlayer\realplay.exe" /RunUPGToolCommandReBoot
O4 - Startup: Norton Internet Security.lnk = ?
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Norton GoBack.lnk = C:\Program Files\Norton SystemWorks Basic Edition\Norton GoBack\GBTray.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll
O9 - Extra button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Basic Edition\Norton Cleanup\WCQuick.lnk
O9 - Extra 'Tools' menuitem: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Basic Edition\Norton Cleanup\WCQuick.lnk
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/02ab3c755b7290…ip/RdxIE601.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://scan.safety.live.com/resource/downl…lscbase7617.cab
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1122233795328
O16 - DPF: {74C861A1-D548-4916-BC8A-FDE92EDFF62C} - http://mediaplayer.walmart.com/installer/install.cab
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/…/ymmapi_416.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: xvguuluh - C:\WINDOWS\SYSTEM32\xvguuluh.dll
O20 - Winlogon Notify: yayvutr - C:\WINDOWS\SYSTEM32\yayvutr.dll
O23 - Service: AOL Instant Messenger (AOL Instant Messenger) - Unknown owner - C:\WINDOWS\msnmsgr.exe (file missing)
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h cltCommon (file missing)
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: GoBack Polling Service (GBPoll) - Symantec Corporation - C:\Program Files\Norton SystemWorks Basic Edition\Norton GoBack\GBPoll.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

LDTate:

Thanks for looking this over on a Friday night. I have pasted your quote into notepad and then put this in combofix: Here are the logs

Combo Log:

ComboFix 07-11-08.1 - customer 2007-11-16 21:25:16.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.374 [GMT -7:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\customer\Desktop\CFScript.txt
* Created a new restore point

FILE
C:\DOCUME~1\customer\LOCALS~1\Temp\mc22.tmp
c:\program files\peoplepc\toolbar\PPCToolbar.dll
C:\WINDOWS\system32\igxnyqlo.dll
C:\WINDOWS\system32\qdtycgxk.dll
C:\WINDOWS\system32\qphcprxw.dll
C:\WINDOWS\system32\rfykskue.dll
C:\WINDOWS\system32\xvguuluh.dll
C:\WINDOWS\system32\yayvutr.dll
C:\WINDOWS\winstart.bat
.

Unable to gain System Privileges

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\peoplepc
c:\program files\peoplepc\ISP6130\Bin\9XRas.dll
c:\program files\peoplepc\ISP6130\Bin\Crypto.dll
c:\program files\peoplepc\ISP6130\Bin\Downloader.dll
c:\program files\peoplepc\ISP6130\Bin\IniMod.dll
c:\program files\peoplepc\ISP6130\Bin\ISPUtil8.dll
c:\program files\peoplepc\ISP6130\Bin\MailClient.dll
c:\program files\peoplepc\ISP6130\Bin\ODWabUtil.dll
c:\program files\peoplepc\ISP6130\Bin\POP3.INS
c:\program files\peoplepc\ISP6130\Bin\PPCInstall.dll
c:\program files\peoplepc\ISP6130\Bin\PPCLog.dll
c:\program files\peoplepc\ISP6130\Bin\PPCOfso.dll
c:\program files\peoplepc\ISP6130\Bin\PPCOLink.exe
c:\program files\peoplepc\ISP6130\Bin\PPCOXML.dll
c:\program files\peoplepc\ISP6130\Bin\Tapi.dll
c:\program files\peoplepc\ISP6130\Bin\XPRas.dll
c:\program files\peoplepc\ISP6130\Browser\bartlog.log
c:\program files\peoplepc\ISP6130\Browser\BartShel.exe
c:\program files\peoplepc\ISP6130\Browser\PPShared.exe
c:\program files\peoplepc\ISP6130\Help\PeoplePC_QuickHelp.chm
c:\program files\peoplepc\ISP6130\HTA\autoconnect.brt
c:\program files\peoplepc\ISP6130\HTA\Banner.brt
c:\program files\peoplepc\ISP6130\HTA\Banner.htm
c:\program files\peoplepc\ISP6130\HTA\brtdisconnect.brt
c:\program files\peoplepc\ISP6130\HTA\cd.brt
c:\program files\peoplepc\ISP6130\HTA\Configure.brt
c:\program files\peoplepc\ISP6130\HTA\confirm.brt
c:\program files\peoplepc\ISP6130\HTA\confirm2.brt
c:\program files\peoplepc\ISP6130\HTA\connecting.brt
c:\program files\peoplepc\ISP6130\HTA\Content\tips.xml
c:\program files\peoplepc\ISP6130\HTA\Content\wotd.xml
c:\program files\peoplepc\ISP6130\HTA\Data\navigation.xml
c:\program files\peoplepc\ISP6130\HTA\dialog.brt
c:\program files\peoplepc\ISP6130\HTA\disconnect.brt
c:\program files\peoplepc\ISP6130\HTA\download_login.brt
c:\program files\peoplepc\ISP6130\HTA\error.brt
c:\program files\peoplepc\ISP6130\HTA\frame.brt
c:\program files\peoplepc\ISP6130\HTA\harddisconnect.brt
c:\program files\peoplepc\ISP6130\HTA\idledisconnect.brt
c:\program files\peoplepc\ISP6130\HTA\Images\1.gif
c:\program files\peoplepc\ISP6130\HTA\Images\1122233043.ico
c:\program files\peoplepc\ISP6130\HTA\Images\1122233053.ico
c:\program files\peoplepc\ISP6130\HTA\Images\1122233063.ico
c:\program files\peoplepc\ISP6130\HTA\Images\2.gif
c:\program files\peoplepc\ISP6130\HTA\Images\border.gif
c:\program files\peoplepc\ISP6130\HTA\Images\btn_ad_location.gif
c:\program files\peoplepc\ISP6130\HTA\Images\btn_add_numbers.gif
c:\program files\peoplepc\ISP6130\HTA\Images\btn_add_numbers2.gif
c:\program files\peoplepc\ISP6130\HTA\Images\btn_agree_off.gif
c:\program files\peoplepc\ISP6130\HTA\Images\btn_agree_on.gif
c:\program files\peoplepc\ISP6130\HTA\Images\btn_Back.gif
c:\program files\peoplepc\ISP6130\HTA\Images\btn_Cancel.gif
c:\program files\peoplepc\ISP6130\HTA\Images\btn_cancel2.gif
c:\program files\peoplepc\ISP6130\HTA\Images\btn_cancel3.gif
c:\program files\peoplepc\ISP6130\HTA\Images\btn_close_window2.gif
c:\program files\peoplepc\ISP6130\HTA\Images\btn_connect.gif
c:\program files\peoplepc\ISP6130\HTA\Images\btn_connect2.gif
c:\program files\peoplepc\ISP6130\HTA\Images\btn_continue.gif
c:\program files\peoplepc\ISP6130\HTA\Images\btn_continue_setup.gif
c:\program files\peoplepc\ISP6130\HTA\Images\btn_continue2.gif
c:\program files\peoplepc\ISP6130\HTA\Images\btn_ContinueInstallation.gif
c:\program files\peoplepc\ISP6130\HTA\Images\btn_ContinuePreviousInstallation.gif
c:\program files\peoplepc\ISP6130\HTA\Images\btn_disagree_off.gif
c:\program files\peoplepc\ISP6130\HTA\Images\btn_disagree_on.gif
c:\program files\peoplepc\ISP6130\HTA\Images\btn_disconnect.gif
c:\program files\peoplepc\ISP6130\HTA\Images\btn_Finish.gif
c:\program files\peoplepc\ISP6130\HTA\Images\btn_help.gif
c:\program files\peoplepc\ISP6130\HTA\Images\btn_help2.gif
c:\program files\peoplepc\ISP6130\HTA\Images\btn_hidedetails.gif
c:\program files\peoplepc\ISP6130\HTA\Images\btn_moredetails.gif
c:\program files\peoplepc\ISP6130\HTA\Images\btn_Next.gif
c:\program files\peoplepc\ISP6130\HTA\Images\btn_No.gif
c:\program files\peoplepc\ISP6130\HTA\Images\btn_OK.gif
c:\program files\peoplepc\ISP6130\HTA\Images\btn_OK2.gif
c:\program files\peoplepc\ISP6130\HTA\Images\btn_reconnect_now.gif
c:\program files\peoplepc\ISP6130\HTA\Images\btn_rename_location.gif
c:\program files\peoplepc\ISP6130\HTA\Images\btn_retry.gif
c:\program files\peoplepc\ISP6130\HTA\Images\btn_reviewdialing.gif
c:\program files\peoplepc\ISP6130\HTA\Images\btn_sign_in_now.gif
c:\program files\peoplepc\ISP6130\HTA\Images\btn_SignUpNow.gif
c:\program files\peoplepc\ISP6130\HTA\Images\btn_skip_step.gif
c:\program files\peoplepc\ISP6130\HTA\Images\btn_stay_online.gif
c:\program files\peoplepc\ISP6130\HTA\Images\btn_stayonline.gif
c:\program files\peoplepc\ISP6130\HTA\Images\btn_StopInstallation.gif
c:\program files\peoplepc\ISP6130\HTA\Images\btn_tryagain.gif
c:\program files\peoplepc\ISP6130\HTA\Images\btn_TryNextNumber.gif
c:\program files\peoplepc\ISP6130\HTA\Images\btn_workoffline.gif
c:\program files\peoplepc\ISP6130\HTA\Images\btn_Yes.gif
c:\program files\peoplepc\ISP6130\HTA\Images\cancel2_btn.gif
c:\program files\peoplepc\ISP6130\HTA\Images\cd_signin_gradient.gif
c:\program files\peoplepc\ISP6130\HTA\Images\check_blue.gif
c:\program files\peoplepc\ISP6130\HTA\Images\check_orange.gif
c:\program files\peoplepc\ISP6130\HTA\Images\check_red.gif
c:\program files\peoplepc\ISP6130\HTA\Images\closex.gif
c:\program files\peoplepc\ISP6130\HTA\Images\confirm_background_gradient_left.gif
c:\program files\peoplepc\ISP6130\HTA\Images\confirm_background_gradient_main.gif
c:\program files\peoplepc\ISP6130\HTA\Images\confirm_background_gradient_right.gif
c:\program files\peoplepc\ISP6130\HTA\Images\Content\totd.gif
c:\program files\peoplepc\ISP6130\HTA\Images\Content\wotd.gif
c:\program files\peoplepc\ISP6130\HTA\Images\content_frame_lft.gif
c:\program files\peoplepc\ISP6130\HTA\Images\content_frame_lft.jpg
c:\program files\peoplepc\ISP6130\HTA\Images\content_frame_rt.gif
c:\program files\peoplepc\ISP6130\HTA\Images\content_frame_rt.jpg
c:\program files\peoplepc\ISP6130\HTA\Images\corner_login_botleft.gif
c:\program files\peoplepc\ISP6130\HTA\Images\corner_login_botright.gif
c:\program files\peoplepc\ISP6130\HTA\Images\corner_login_side.gif
c:\program files\peoplepc\ISP6130\HTA\Images\corner_login_topleft.gif
c:\program files\peoplepc\ISP6130\HTA\Images\corner_login_topright.gif
c:\program files\peoplepc\ISP6130\HTA\Images\error_alert.gif
c:\program files\peoplepc\ISP6130\HTA\Images\error_background_gradient_bottom.gif
c:\program files\peoplepc\ISP6130\HTA\Images\error_background_gradient_leftbottom.gif
c:\program files\peoplepc\ISP6130\HTA\Images\error_background_gradient_leftmain.gif
c:\program files\peoplepc\ISP6130\HTA\Images\error_background_gradient_lefttop.gif
c:\program files\peoplepc\ISP6130\HTA\Images\error_background_gradient_main.gif
c:\program files\peoplepc\ISP6130\HTA\Images\error_background_gradient_rightbottom.gif
c:\program files\peoplepc\ISP6130\HTA\Images\error_background_gradient_rightmain.gif
c:\program files\peoplepc\ISP6130\HTA\Images\error_background_gradient_righttop.gif
c:\program files\peoplepc\ISP6130\HTA\Images\error_background_gradient_top.gif
c:\program files\peoplepc\ISP6130\HTA\Images\finished_btn.gif
c:\program files\peoplepc\ISP6130\HTA\Images\finished_icon.gif
c:\program files\peoplepc\ISP6130\HTA\Images\finished_icon1.gif
c:\program files\peoplepc\ISP6130\HTA\Images\getstarted_notify.gif
c:\program files\peoplepc\ISP6130\HTA\Images\glassblock.gif
c:\program files\peoplepc\ISP6130\HTA\Images\header_arrows.gif
c:\program files\peoplepc\ISP6130\HTA\Images\header_Choose_Option.gif
c:\program files\peoplepc\ISP6130\HTA\Images\header_connecting.gif
c:\program files\peoplepc\ISP6130\HTA\Images\header_notify.gif
c:\program files\peoplepc\ISP6130\HTA\Images\header_settings.gif
c:\program files\peoplepc\ISP6130\HTA\Images\header_welcome.gif
c:\program files\peoplepc\ISP6130\HTA\Images\icon_connecting_bullet.gif
c:\program files\peoplepc\ISP6130\HTA\Images\icon_connecting_step1.gif
c:\program files\peoplepc\ISP6130\HTA\Images\icon_connecting_step2.gif
c:\program files\peoplepc\ISP6130\HTA\Images\icon_connecting_step3.gif
c:\program files\peoplepc\ISP6130\HTA\Images\install_gradient.gif
c:\program files\peoplepc\ISP6130\HTA\Images\install_logo.gif
c:\program files\peoplepc\ISP6130\HTA\Images\InstallBackground.gif
c:\program files\peoplepc\ISP6130\HTA\Images\InstallComplete.gif
c:\program files\peoplepc\ISP6130\HTA\Images\installprogressbar_box.gif
c:\program files\peoplepc\ISP6130\HTA\Images\login_background_gradient.gif
c:\program files\peoplepc\ISP6130\HTA\Images\login_background_gradient.jpg
c:\program files\peoplepc\ISP6130\HTA\Images\logo.gif
c:\program files\peoplepc\ISP6130\HTA\Images\logo_notify.gif
c:\program files\peoplepc\ISP6130\HTA\Images\navigation_arrow_blue.gif
c:\program files\peoplepc\ISP6130\HTA\Images\navigation_arrow_flyout.gif
c:\program files\peoplepc\ISP6130\HTA\Images\navigation_arrow_orange.gif
c:\program files\peoplepc\ISP6130\HTA\Images\navigation_arrow_steps.gif
c:\program files\peoplepc\ISP6130\HTA\Images\next_btn2.gif
c:\program files\peoplepc\ISP6130\HTA\Images\non_member_signup.gif
c:\program files\peoplepc\ISP6130\HTA\Images\notify_line.gif
c:\program files\peoplepc\ISP6130\HTA\Images\or.gif
c:\program files\peoplepc\ISP6130\HTA\Images\page_background_gradient.gif
c:\program files\peoplepc\ISP6130\HTA\Images\page_background_gradient.jpg
c:\program files\peoplepc\ISP6130\HTA\Images\phone_icon.gif
c:\program files\peoplepc\ISP6130\HTA\Images\phone_icon1.gif
c:\program files\peoplepc\ISP6130\HTA\Images\photo_background_gradient.gif
c:\program files\peoplepc\ISP6130\HTA\Images\photo_default.jpg
c:\program files\peoplepc\ISP6130\HTA\Images\PPC_DrkBlue_icon.gif
c:\program files\peoplepc\ISP6130\HTA\Images\ppc_powered.gif
c:\program files\peoplepc\ISP6130\HTA\Images\progressbar_box.gif
c:\program files\peoplepc\ISP6130\HTA\Images\reg_progress_bar_start.gif
c:\program files\peoplepc\ISP6130\HTA\Images\reg_progress_bar_stop.gif
c:\program files\peoplepc\ISP6130\HTA\Images\selectbox_arrow.gif
c:\program files\peoplepc\ISP6130\HTA\Images\send_btn.gif
c:\program files\peoplepc\ISP6130\HTA\Images\send_notification_btn.gif
c:\program files\peoplepc\ISP6130\HTA\Images\shadowbox_frame.gif
c:\program files\peoplepc\ISP6130\HTA\Images\smheader_settings.gif
c:\program files\peoplepc\ISP6130\HTA\Images\spacer.gif
c:\program files\peoplepc\ISP6130\HTA\Images\stay_online_off.gif
c:\program files\peoplepc\ISP6130\HTA\Images\stay_online_on.gif
c:\program files\peoplepc\ISP6130\HTA\Images\subheader_member.gif
c:\program files\peoplepc\ISP6130\HTA\Images\subheader_no_member.gif
c:\program files\peoplepc\ISP6130\HTA\Images\systray_offline.ico
c:\program files\peoplepc\ISP6130\HTA\Images\systray_online.ico
c:\program files\peoplepc\ISP6130\HTA\Images\talking_icon.gif
c:\program files\peoplepc\ISP6130\HTA\Images\talking_icon1.gif
c:\program files\peoplepc\ISP6130\HTA\Images\text_connectionsettings.gif
c:\program files\peoplepc\ISP6130\HTA\Images\wave.gif
c:\program files\peoplepc\ISP6130\HTA\Images\Web_Install_6.0.gif
c:\program files\peoplepc\ISP6130\HTA\LoadError.brt
c:\program files\peoplepc\ISP6130\HTA\login.brt
c:\program files\peoplepc\ISP6130\HTA\mail_notify.brt
c:\program files\peoplepc\ISP6130\HTA\mail_notify_finished.brt
c:\program files\peoplepc\ISP6130\HTA\mail_notify_instructions.brt
c:\program files\peoplepc\ISP6130\HTA\mail_notify_notice.brt
c:\program files\peoplepc\ISP6130\HTA\main.brt
c:\program files\peoplepc\ISP6130\HTA\manual.brt
c:\program files\peoplepc\ISP6130\HTA\password\password.brt
c:\program files\peoplepc\ISP6130\HTA\PPC_DrkBlue_icon.gif
c:\program files\peoplepc\ISP6130\HTA\progress.brt
c:\program files\peoplepc\ISP6130\HTA\radius_harddisconnect.brt
c:\program files\peoplepc\ISP6130\HTA\reconnect.brt
c:\program files\peoplepc\ISP6130\HTA\reconnect_reg.brt
c:\program files\peoplepc\ISP6130\HTA\Scripts\bart.js
c:\program files\peoplepc\ISP6130\HTA\Scripts\content.js
c:\program files\peoplepc\ISP6130\HTA\Scripts\display.js
c:\program files\peoplepc\ISP6130\HTA\Scripts\download.js
c:\program files\peoplepc\ISP6130\HTA\Scripts\mail.js
c:\program files\peoplepc\ISP6130\HTA\Scripts\menu.js
c:\program files\peoplepc\ISP6130\HTA\Scripts\popup.js
c:\program files\peoplepc\ISP6130\HTA\Scripts\propel.js
c:\program files\peoplepc\ISP6130\HTA\Scripts\softwarelog.js
c:\program files\peoplepc\ISP6130\HTA\Scripts\sound.js
c:\program files\peoplepc\ISP6130\HTA\Scripts\toast.js
c:\program files\peoplepc\ISP6130\HTA\Scripts\utils.js
c:\program files\peoplepc\ISP6130\HTA\sessiontimeout.brt
c:\program files\peoplepc\ISP6130\HTA\settings_accessnumbers.brt
c:\program files\peoplepc\ISP6130\HTA\settings_advanced.brt
c:\program files\peoplepc\ISP6130\HTA\settings_connectiontype.brt
c:\program files\peoplepc\ISP6130\HTA\settings_editnumbers.brt
c:\program files\peoplepc\ISP6130\HTA\settings_locations.brt
c:\program files\peoplepc\ISP6130\HTA\station.brt
c:\program files\peoplepc\ISP6130\HTA\Style\global.css
c:\program files\peoplepc\ISP6130\HTA\Style\modal.css
c:\program files\peoplepc\ISP6130\HTA\Toasts\deal.brt
c:\program files\peoplepc\ISP6130\HTA\Toasts\deal.htm
c:\program files\peoplepc\ISP6130\HTA\Toasts\images\deal_bgd.jpg
c:\program files\peoplepc\ISP6130\HTA\Toasts\images\deal_crnr.gif
c:\program files\peoplepc\ISP6130\HTA\Toasts\images\deal_hdr.gif
c:\program files\peoplepc\ISP6130\HTA\Toasts\images\deal_icon.gif
c:\program files\peoplepc\ISP6130\HTA\Toasts\images\email.gif
c:\program files\peoplepc\ISP6130\HTA\Toasts\images\toast_bgd.jpg
c:\program files\peoplepc\ISP6130\HTA\Toasts\mail.brt
c:\program files\peoplepc\ISP6130\HTA\Toasts\mail.htm
c:\program files\peoplepc\ISP6130\HTA\Toasts\url.brt
c:\program files\peoplepc\ISP6130\HTA\Toasts\url.htm
c:\program files\peoplepc\ISP6130\PPCComp.ini
c:\program files\peoplepc\ISP6130\SmartDialer\CallRecordManager\CallRecord.dll
c:\program files\peoplepc\ISP6130\SmartDialer\CallRecordManager\CallRecords\callrec.dat
c:\program files\peoplepc\ISP6130\SmartDialer\CallRecordManager\CallRecordsdms.log
c:\program files\peoplepc\ISP6130\SmartDialer\Dialer.log
c:\program files\peoplepc\ISP6130\SmartDialer\DLL\autodial.dll
c:\program files\peoplepc\ISP6130\SmartDialer\DLL\CustomDial.dll
c:\program files\peoplepc\ISP6130\SmartDialer\DLL\Dialer.dll
c:\program files\peoplepc\ISP6130\SmartDialer\Locations\Locations.dll
c:\program files\peoplepc\ISP6130\SmartDialer\Phonebooks\My Home.xml
c:\program files\peoplepc\ISP6130\SmartDialer\Phonebooks\Nanpa.csv
c:\program files\peoplepc\ISP6130\SmartDialer\Phonebooks\pbook.xml
c:\program files\peoplepc\ISP6130\SmartDialer\Phonebooks\pbook.xml.bz
c:\program files\peoplepc\ISP6130\SmartDialer\Phonebooks\PhoneBook.dll
c:\program files\peoplepc\ISP6130\SmartDialer\Phonebooks\Temp\303.srt
c:\program files\peoplepc\ISP6130\SmartDialer\Phonebooks\Temp\307.srt
c:\program files\peoplepc\ISP6130\SmartDialer\Phonebooks\Temp\719.srt
c:\program files\peoplepc\ISP6130\SmartDialer\Phonebooks\Temp\970.srt
c:\program files\peoplepc\ISP6130\SmartDialer\Phonebooks\Temp\AreaCities.srt
c:\program files\peoplepc\ISP6130\SmartDialer\Phonebooks\Temp\Master.srt
c:\program files\peoplepc\ISP6130\SmartDialer\Updates\dir.dat
c:\program files\peoplepc\ISP6130\SmartDialer\Users\Users.dll
c:\program files\peoplepc\Toolbar\autils.dll
c:\program files\peoplepc\Toolbar\block.wav
c:\program files\peoplepc\Toolbar\peoplepal.htm
c:\program files\peoplepc\Toolbar\peoplepc.ico
c:\program files\peoplepc\Toolbar\PPCToolbar.dll
C:\WINDOWS\system32\igxnyqlo.dll
C:\WINDOWS\system32\qdtycgxk.dll
C:\WINDOWS\system32\qphcprxw.dll
C:\WINDOWS\system32\rfykskue.dll
C:\WINDOWS\system32\xvguuluh.dll
C:\WINDOWS\system32\xvguuluh.dllbox
C:\WINDOWS\system32\yayvutr.dll
C:\WINDOWS\winstart.bat

.
((((((((((((((((((((((((( Files Created from 2007-10-17 to 2007-11-17 )))))))))))))))))))))))))))))))
.

2007-11-13 22:31 51,200 –a—— C:\WINDOWS\NirCmd.exe
2007-11-13 20:22 d——– C:\Program Files\RegCure
2007-10-30 19:55 625,032 –a—— C:\WINDOWS\system32\SymNeti.dll
2007-10-30 19:55 242,056 –a—— C:\WINDOWS\system32\SymRedir.dll
2007-10-30 19:55 191,536 –a—— C:\WINDOWS\system32\drivers\symtdi.sys
2007-10-30 19:55 145,968 –a—— C:\WINDOWS\system32\drivers\symfw.sys
2007-10-30 19:55 39,856 –a—— C:\WINDOWS\system32\drivers\symids.sys
2007-10-30 19:55 37,936 –a—— C:\WINDOWS\system32\drivers\symndisv.sys
2007-10-30 19:55 35,120 –a—— C:\WINDOWS\system32\drivers\symndis.sys
2007-10-30 19:55 27,696 –a—— C:\WINDOWS\system32\drivers\symredrv.sys
2007-10-30 19:55 12,848 –a—— C:\WINDOWS\system32\drivers\symdns.sys
2007-10-30 16:15 429 –a—— C:\WINDOWS\C3DPREFS.DAT
2007-10-21 16:11 d——– C:\Program Files\iStar

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-16 21:36 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2007-11-16 03:44 ——— d—–w C:\Program Files\Norton Internet Security
2007-11-15 03:08 ——— d—–w C:\Documents and Settings\All Users\Application Data\Symantec
2007-11-13 02:15 ——— d—–w C:\Documents and Settings\customer\Application Data\Apple Computer
2007-11-02 23:42 805 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2007-11-02 23:42 123,952 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2007-11-02 23:42 10,740 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2007-11-02 23:42 ——— d—–w C:\Program Files\Symantec
2007-10-31 02:24 12,963 —-a-w C:\WINDOWS\system32\drivers\SymRedir.cat
2007-10-31 02:24 1,358 —-a-w C:\WINDOWS\system32\drivers\SymRedir.inf
2007-09-18 20:44 10,662 —-a-w C:\WINDOWS\system32\drivers\srtspx.cat
2007-09-18 20:44 10,662 —-a-w C:\WINDOWS\system32\drivers\srtspl.cat
2007-09-18 20:44 10,658 —-a-w C:\WINDOWS\system32\drivers\srtsp.cat
2007-09-18 20:44 1,430 —-a-w C:\WINDOWS\system32\drivers\srtspl.inf
2007-09-18 20:44 1,421 —-a-w C:\WINDOWS\system32\drivers\srtspx.inf
2007-09-18 20:44 1,415 —-a-w C:\WINDOWS\system32\drivers\srtsp.inf
2007-09-18 20:43 43,696 —-a-w C:\WINDOWS\system32\drivers\srtspx.sys
2007-09-18 20:43 317,616 —-a-w C:\WINDOWS\system32\drivers\srtspl.sys
2007-09-18 20:43 278,576 —-a-w C:\WINDOWS\system32\drivers\srtsp.sys
.

((((((((((((((((((((((((((((( snapshot@2007-11-13_22.58.51.07 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-11-13 05:22:24 52,764 —-a-w C:\WINDOWS\system32\perfc009.dat
+ 2007-11-16 04:47:27 52,764 —-a-w C:\WINDOWS\system32\perfc009.dat
- 2007-11-13 05:22:24 380,350 —-a-w C:\WINDOWS\system32\perfh009.dat
+ 2007-11-16 04:47:27 380,350 —-a-w C:\WINDOWS\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2004-05-02 18:35]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-12-28 15:48]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 17:20]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-09 22:59]
"osCheck"="C:\Program Files\Norton Internet Security\osCheck.exe" [2007-01-14 00:11]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 17:30]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-09 09:59]
"Spyware Doctor"="C:\PROGRA~1\SPYWAR~1\swdoctor.exe" [2006-02-06 14:40]
"RealPlayer"="C:\Program Files\Real\RealPlayer\realplay.exe" [2006-06-19 09:24]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runservices]
"Compaq32 Service Drivers"=msconfig32.exe
"MediaXPServicePack"=mxpsp.exe
"Compd Service Drivrs"=codq.exe

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"VIEW POINT DRIVERS"=phqghum.exe
"Compaq32 Service Drivers"=msconfig32.exe
"MediaXPServicePack"=mxpsp.exe
"Compd Service Drivrs"=codq.exe
"CPU Temp Control"=wuitgurd.exe
"Spyware Doctor"="C:\Program Files\Spyware Doctor\swdoctor.exe" /Q

C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\
Acrobat Distiller 5.0.lnk - C:\Program Files\Adobe\Acrobat 5.0\Distillr\acrodist.exe [2007-05-02 21:37:23]
Adobe Acrobat 5.0.lnk - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\Acrobat.exe [2007-05-02 21:36:50]
Microsoft Access.lnk - C:\WINDOWS\Installer\{00000409-78E1-11D2-B60F-006097C998E7}\accicons.exe [2004-05-01 14:29:14]
Microsoft Excel.lnk - C:\WINDOWS\Installer\{00000409-78E1-11D2-B60F-006097C998E7}\xlicons.exe [2004-05-01 14:29:14]
Microsoft FrontPage.lnk - C:\WINDOWS\Installer\{00000409-78E1-11D2-B60F-006097C998E7}\misc.exe [2004-05-01 14:29:14]
Microsoft Outlook.lnk - C:\WINDOWS\Installer\{00000409-78E1-11D2-B60F-006097C998E7}\outicon.exe [2004-05-01 14:29:14]
Microsoft PowerPoint.lnk - C:\WINDOWS\Installer\{00000409-78E1-11D2-B60F-006097C998E7}\pptico.exe [2004-05-01 14:29:14]
Microsoft Word.lnk - C:\WINDOWS\Installer\{00000409-78E1-11D2-B60F-006097C998E7}\wordicon.exe [2004-05-01 14:29:14]
MSN 8.lnk - C:\Program Files\MSN\MSNCoreFiles\msn6.exe [2004-05-06 04:23:19]
MSN Messenger 5.0.lnk - C:\WINDOWS\Installer\{ABEB838C-A1A7-4C5D-B7E1-8B4314B00527}\MsblIco.Exe [2006-04-03 15:54:21]
NeroMediaPlayer.lnk - C:\Program Files\Ahead\NeroMediaPlayer\NeroMediaPlayer.exe [2004-05-01 14:22:50]

C:\Documents and Settings\customer\Start Menu\Programs\Startup\
Norton Internet Security.lnk - C:\Program Files\Common Files\Symantec Shared\NMAIN.EXE [2006-07-19 10:45:14]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Acrobat Assistant.lnk - C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe [2007-05-02 21:37:28]
Norton GoBack.lnk - C:\Program Files\Norton SystemWorks Basic Edition\Norton GoBack\GBTray.exe [2006-07-19 10:45:12]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoViewOnDrive"=0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Defragmentation Manager]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\DHCP Client]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NetDDEsrv]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Perfhmon]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\upnpdrv]
@="Service"

R0 BsStor;InCD Storage Helper Driver;C:\WINDOWS\system32\DRIVERS\bsstor.sys
R0 GBDevice;GBDevice;C:\WINDOWS\system32\drivers\GBDevice.sys
R0 GoBack2K;GoBack2K;C:\WINDOWS\system32\drivers\GoBack2K.sys
R2 BCMNTIO;BCMNTIO;\??\C:\PROGRA~1\CheckIt\DIAGNO~1\BCMNTIO.sys
R2 BsUDF;InCD UDF Driver;C:\WINDOWS\system32\drivers\BsUDF.sys
R2 MAPMEM;MAPMEM;\??\C:\PROGRA~1\CheckIt\DIAGNO~1\MAPMEM.sys
R2 ousbehci;NEC PCI to USB Enhanced Host Controller;C:\WINDOWS\system32\Drivers\ousbehci.sys
R3 Intels51;Intel® 536EP Modem;C:\WINDOWS\system32\DRIVERS\Intels51.sys
S2 GBFSHook;GBFSHook;C:\WINDOWS\system32\drivers\GBFSHook.sys
S3 msvnc;msvnc;\??\C:\WINDOWS\system32\msvnc.sys
S3 SDVC05;USB SDVC05;C:\WINDOWS\system32\Drivers\SDVC05.sys
S3 SNDO763;ViviCam 3350B;C:\WINDOWS\system32\DRIVERS\sndo763.sys

*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder
"2007-11-17 04:47:34 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
"2007-11-13 03:00:08 C:\WINDOWS\Tasks\Norton Internet Security - Run Full System Scan - customer.job"
"2007-10-01 18:04:09 C:\WINDOWS\Tasks\Norton SystemWorks One Button Checkup.job"
"2007-11-17 04:44:24 C:\WINDOWS\Tasks\RegCure Program Check.job"
- C:\Program Files\RegCure\RegCure.exe
"2007-11-14 03:22:35 C:\WINDOWS\Tasks\RegCure.job"
- C:\Program Files\RegCure\RegCure.exe
.
**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-16 21:46:38
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

**************************************************************************
.
Completion time: 2007-11-16 21:50:59 - machine was rebooted
C:\ComboFix2.txt … 2007-11-16 19:54
C:\ComboFix3.txt … 2007-11-13 23:05
.
— E O F —

Hi Jack:

Logfile of HijackThis v1.99.1
Scan saved at 9:53:30 PM, on 11/16/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Norton SystemWorks Basic Edition\Norton GoBack\GBPoll.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\PROGRA~1\SPYWAR~1\swdoctor.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\Norton SystemWorks Basic Edition\Norton GoBack\GBTray.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Hijackthis\Scanner.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://home.peoplepc.com/search
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Spyware Doctor] C:\PROGRA~1\SPYWAR~1\swdoctor.exe /Q
O4 - HKCU\..\Run: [RealPlayer] "C:\Program Files\Real\RealPlayer\realplay.exe" /RunUPGToolCommandReBoot
O4 - Startup: Norton Internet Security.lnk = ?
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Norton GoBack.lnk = C:\Program Files\Norton SystemWorks Basic Edition\Norton GoBack\GBTray.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll
O9 - Extra button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Basic Edition\Norton Cleanup\WCQuick.lnk
O9 - Extra 'Tools' menuitem: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Basic Edition\Norton Cleanup\WCQuick.lnk
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/02ab3c755b7290…ip/RdxIE601.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://scan.safety.live.com/resource/downl…lscbase7617.cab
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1122233795328
O16 - DPF: {74C861A1-D548-4916-BC8A-FDE92EDFF62C} - http://mediaplayer.walmart.com/installer/install.cab
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/…/ymmapi_416.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AOL Instant Messenger (AOL Instant Messenger) - Unknown owner - C:\WINDOWS\msnmsgr.exe (file missing)
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h cltCommon (file missing)
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: GoBack Polling Service (GBPoll) - Symantec Corporation - C:\Program Files\Norton SystemWorks Basic Edition\Norton GoBack\GBPoll.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

LDTate:

Thanks, The computer is booting correctly and working normally. My wife really appreciates this since she has a paper to write. What is Bonjour? I have considered uninstalling it several times, I don't even know where it came from. I assumed it came from the kid's school assignments.

Here is the Hijack log:

Logfile of HijackThis v1.99.1
Scan saved at 11:22:26 PM, on 11/16/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Norton SystemWorks Basic Edition\Norton GoBack\GBPoll.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\PROGRA~1\SPYWAR~1\swdoctor.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\Norton SystemWorks Basic Edition\Norton GoBack\GBTray.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\alg.exe
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
C:\Program Files\Symantec\LiveUpdate\AUPDATE.EXE
C:\Program Files\Hijackthis\Scanner.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://home.peoplepc.com/search
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Spyware Doctor] C:\PROGRA~1\SPYWAR~1\swdoctor.exe /Q
O4 - HKCU\..\Run: [RealPlayer] "C:\Program Files\Real\RealPlayer\realplay.exe" /RunUPGToolCommandReBoot
O4 - Startup: Norton Internet Security.lnk = ?
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Norton GoBack.lnk = C:\Program Files\Norton SystemWorks Basic Edition\Norton GoBack\GBTray.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll
O9 - Extra button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Basic Edition\Norton Cleanup\WCQuick.lnk
O9 - Extra 'Tools' menuitem: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Basic Edition\Norton Cleanup\WCQuick.lnk
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/02ab3c755b7290…ip/RdxIE601.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://scan.safety.live.com/resource/downl…lscbase7617.cab
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1122233795328
O16 - DPF: {74C861A1-D548-4916-BC8A-FDE92EDFF62C} - http://mediaplayer.walmart.com/installer/install.cab
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/…/ymmapi_416.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AOL Instant Messenger (AOL Instant Messenger) - Unknown owner - C:\WINDOWS\msnmsgr.exe (file missing)
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h cltCommon (file missing)
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: GoBack Polling Service (GBPoll) - Symantec Corporation - C:\Program Files\Norton SystemWorks Basic Edition\Norton GoBack\GBPoll.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe