[Resolved] Heap of Trouble :Win32.Backdoor.Agent & Others

I got nailed the other day with a mess of trojans. It has impacted userinit.exe and when connceted to the internet I get a proliferation email attempts .. I'm running XP. I've scanned with Adaware SE and Norton Internet Security in Safe Mode. I think it keeps mutating.

Can someone help me? Here's my Hijack log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:17:32 AM, on 12/25/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\WINDOWS\system32\LVComsX.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://www.dellnet.com
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.7\NppBho.dll
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: MySpace Customizer Toolbar - {423a0a67-20c5-4b79-a4b7-2456e79acf5a} - C:\Program Files\MySpace_Customizer\tbMyS1.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: (no name) - {B2C4B923-9C8B-4A7B-B2E5-2F0BC4F024DE} - (no file)
O3 - Toolbar: MySpace Customizer Toolbar - {423a0a67-20c5-4b79-a4b7-2456e79acf5a} - C:\Program Files\MySpace_Customizer\tbMyS1.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.7\UIBHO.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Verizon_McciTrayApp] C:\Program Files\Verizon\McciTrayApp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\PROGRAM FILES\QUICKTIME\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: CachePal - {5F4A4622-8370-440e-88CC-CA2256D1A08A} - C:\WINDOWS\System32\cachepal.exe
O9 - Extra 'Tools' menuitem: CachePal - {5F4A4622-8370-440e-88CC-CA2256D1A08A} - C:\WINDOWS\System32\cachepal.exe
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://activatemyfios.verizon.net/sdcCommo…IOS/tgctlcm.cab
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {13EC55CF-D993-475B-9ACA-F4A384957956} (Controller Class) - https://www.windowsonecare.com/install/cli/…nSSWebAgent.CAB
O16 - DPF: {31E68DE2-5548-4B23-88F0-C51E6A0F695E} (Microsoft PID Sniffer) - https://support.microsoft.com/OAS/ActiveX/odc.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1143671063531
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.napster.com/client/isetup.cab
O16 - DPF: {94B82441-A413-4E43-8422-D49930E69764} (TLIEFlashObj Class) - https://webchat.dell.com/Media/VisitorChat/TLIEFlash.CAB
O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {E856B973-45FD-4559-8F82-EAB539144667} (Dell PC Checkup Installer Control) - http://pccheckup.dellfix.com/rel/35/install/gtdownde.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\480\G2AWinLogon.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6253\SAService.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

–
End of file - 8125 bytes

Thanks for the reply. When I have the PC connected to my FIOS Router it sends out a non-stop stream of email attempts which triggers fake Symantec dialog boxes with redirects that take control of the mouse and pointer. I also use a program called WinPatrol and it triggers endless startup attempts to the userinit.exe log on function, which seems to have been over-written. It must do something to the registry that resets on re-boot. I have system restore turned off. My log follows;



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:53:44 PM, on 12/28/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\SiteAdvisor\6253\SAService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Verizon\McciTrayApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://63.138.132.82/exchange
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dellnet.com/
R3 - URLSearchHook: MySpace Customizer Toolbar - {423a0a67-20c5-4b79-a4b7-2456e79acf5a} - C:\Program Files\MySpace_Customizer\tbMyS1.dll
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://my.yahoo.com/p/d.html?v"); (C:\Documents and Settings\HMAN\Application Data\Mozilla\Profiles\default\5sih44uv.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_02.src"); (C:\Documents and Settings\HMAN\Application Data\Mozilla\Profiles\default\5sih44uv.slt\prefs.js)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.7\NppBho.dll
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: MySpace Customizer Toolbar - {423a0a67-20c5-4b79-a4b7-2456e79acf5a} - C:\Program Files\MySpace_Customizer\tbMyS1.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: (no name) - {B2C4B923-9C8B-4A7B-B2E5-2F0BC4F024DE} - (no file)
O3 - Toolbar: MySpace Customizer Toolbar - {423a0a67-20c5-4b79-a4b7-2456e79acf5a} - C:\Program Files\MySpace_Customizer\tbMyS1.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.7\UIBHO.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Verizon_McciTrayApp] C:\Program Files\Verizon\McciTrayApp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\PROGRAM FILES\QUICKTIME\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: CachePal - {5F4A4622-8370-440e-88CC-CA2256D1A08A} - C:\WINDOWS\System32\cachepal.exe
O9 - Extra 'Tools' menuitem: CachePal - {5F4A4622-8370-440e-88CC-CA2256D1A08A} - C:\WINDOWS\System32\cachepal.exe
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted IP range: http://192.168.1.1
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://activatemyfios.verizon.net/sdcCommo…IOS/tgctlcm.cab
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/u…can_unicode.cab
O16 - DPF: {13EC55CF-D993-475B-9ACA-F4A384957956} (Controller Class) - https://www.windowsonecare.com/install/cli/…nSSWebAgent.CAB
O16 - DPF: {31E68DE2-5548-4B23-88F0-C51E6A0F695E} (Microsoft PID Sniffer) - https://support.microsoft.com/OAS/ActiveX/odc.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1143671063531
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.napster.com/client/isetup.cab
O16 - DPF: {94B82441-A413-4E43-8422-D49930E69764} (TLIEFlashObj Class) - https://webchat.dell.com/Media/VisitorChat/TLIEFlash.CAB
O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {E856B973-45FD-4559-8F82-EAB539144667} (Dell PC Checkup Installer Control) - http://pccheckup.dellfix.com/rel/35/install/gtdownde.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\480\G2AWinLogon.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6253\SAService.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

–
End of file - 9718 bytes

Checking file system on E:
The type of the file system is FAT.

The volume is dirty.
Volume Serial Number is 1103-221F
Errors in file allocation table (FAT) corrected.
The size of the \oct\v\handjobmovie.org_jmn04.mpeg entry is not valid.
The \oct\v\take3.mpg entry contains a nonvalid link.
The size of the \oct\v\take3.mpg entry is not valid.
\Indiana\Administrative\Oct05 Deposit Memo.doc first allocation unit is not valid. The entry will be truncated.
Bad links in lost chain at cluster 57345 corrected.
Bad links in lost chain at cluster 57346 corrected.
Bad links in lost chain at cluster 57347 corrected.
Bad links in lost chain at cluster 57348 corrected.
Bad links in lost chain at cluster 57349 corrected.
Bad links in lost chain at cluster 57350 corrected.
Bad links in lost chain at cluster 57351 corrected.
Lost chain cross-linked at cluster 57352. Orphan truncated.
Lost chain cross-linked at cluster 57353. Orphan truncated.
Bad links in lost chain at cluster 57354 corrected.
Lost chain cross-linked at cluster 57355. Orphan truncated.
Lost chain cross-linked at cluster 57356. Orphan truncated.
Lost chain cross-linked at cluster 57357. Orphan truncated.
Lost chain cross-linked at cluster 57358. Orphan truncated.
Lost chain cross-linked at cluster 57359. Orphan truncated.
Lost chain cross-linked at cluster 57360. Orphan truncated.
Lost chain cross-linked at cluster 57361. Orphan truncated.
Lost chain cross-linked at cluster 57362. Orphan truncated.
Bad links in lost chain at cluster 57363 corrected.
Lost chain cross-linked at cluster 57364. Orphan truncated.
Lost chain cross-linked at cluster 57365. Orphan truncated.
Lost chain cross-linked at cluster 57366. Orphan truncated.
Lost chain cross-linked at cluster 57367. Orphan truncated.
Lost chain cross-linked at cluster 57368. Orphan truncated.
Lost chain cross-linked at cluster 57369. Orphan truncated.
Lost chain cross-linked at cluster 57370. Orphan truncated.
Lost chain cross-linked at cluster 57371. Orphan truncated.
Lost chain cross-linked at cluster 57372. Orphan truncated.
Lost chain cross-linked at cluster 57373. Orphan truncated.
Lost chain cross-linked at cluster 57374. Orphan truncated.
Lost chain cross-linked at cluster 57375. Orphan truncated.
Bad links in lost chain at cluster 57376 corrected.
Bad links in lost chain at cluster 57377 corrected.
Bad links in lost chain at cluster 57378 corrected.
Bad links in lost chain at cluster 57379 corrected.
Bad links in lost chain at cluster 57380 corrected.
Bad links in lost chain at cluster 57381 corrected.
Bad links in lost chain at cluster 57382 corrected.
Bad links in lost chain at cluster 57383 corrected.
Bad links in lost chain at cluster 57384 corrected.
Bad links in lost chain at cluster 57385 corrected.
Bad links in lost chain at cluster 57386 corrected.
Bad links in lost chain at cluster 57387 corrected.
Bad links in lost chain at cluster 57388 corrected.
Bad links in lost chain at cluster 57389 corrected.
Bad links in lost chain at cluster 57390 corrected.
Bad links in lost chain at cluster 57391 corrected.
Bad links in lost chain at cluster 57392 corrected.
Bad links in lost chain at cluster 57393 corrected.
Bad links in lost chain at cluster 57394 corrected.
Bad links in lost chain at cluster 57395 corrected.
Bad links in lost chain at cluster 57396 corrected.
Bad links in lost chain at cluster 57397 corrected.
Bad links in lost chain at cluster 57398 corrected.
Bad links in lost chain at cluster 57399 corrected.
Bad links in lost chain at cluster 57400 corrected.
Bad links in lost chain at cluster 57401 corrected.
Bad links in lost chain at cluster 57402 corrected.
Bad links in lost chain at cluster 57403 corrected.
Bad links in lost chain at cluster 57404 corrected.
Bad links in lost chain at cluster 57405 corrected.
Bad links in lost chain at cluster 57406 corrected.
Bad links in lost chain at cluster 57407 corrected.
Bad links in lost chain at cluster 57408 corrected.
Bad links in lost chain at cluster 57409 corrected.
Bad links in lost chain at cluster 57410 corrected.
Bad links in lost chain at cluster 57411 corrected.
Bad links in lost chain at cluster 57412 corrected.
Bad links in lost chain at cluster 57413 corrected.
Bad links in lost chain at cluster 57414 corrected.
Bad links in lost chain at cluster 57415 corrected.
Bad links in lost chain at cluster 57416 corrected.
Bad links in lost chain at cluster 57417 corrected.
Bad links in lost chain at cluster 57418 corrected.
Bad links in lost chain at cluster 57419 corrected.
Bad links in lost chain at cluster 57420 corrected.
Bad links in lost chain at cluster 57421 corrected.
Bad links in lost chain at cluster 57422 corrected.
Bad links in lost chain at cluster 57423 corrected.
Bad links in lost chain at cluster 57424 corrected.
Bad links in lost chain at cluster 57425 corrected.
Bad links in lost chain at cluster 57426 corrected.
Bad links in lost chain at cluster 57427 corrected.
Bad links in lost chain at cluster 57428 corrected.
Bad links in lost chain at cluster 57429 corrected.
Bad links in lost chain at cluster 57430 corrected.
Bad links in lost chain at cluster 57431 corrected.
Bad links in lost chain at cluster 57432 corrected.
Bad links in lost chain at cluster 57433 corrected.
Lost chain cross-linked at cluster 57434. Orphan truncated.
Lost chain cross-linked at cluster 57435. Orphan truncated.
Lost chain cross-linked at cluster 57436. Orphan truncated.
Lost chain cross-linked at cluster 57437. Orphan truncated.
Lost chain cross-linked at cluster 57438. Orphan truncated.
Lost chain cross-linked at cluster 57439. Orphan truncated.
Lost chain cross-linked at cluster 57440. Orphan truncated.
Lost chain cross-linked at cluster 57441. Orphan truncated.
Lost chain cross-linked at cluster 57442. Orphan truncated.
Lost chain cross-linked at cluster 57443. Orphan truncated.
Lost chain cross-linked at cluster 57444. Orphan truncated.
Lost chain cross-linked at cluster 57445. Orphan truncated.
Lost chain cross-linked at cluster 57446. Orphan truncated.
Lost chain cross-linked at cluster 57447. Orphan truncated.
Lost chain cross-linked at cluster 57448. Orphan truncated.
Lost chain cross-linked at cluster 57449. Orphan truncated.
Lost chain cross-linked at cluster 57450. Orphan truncated.
Lost chain cross-linked at cluster 57451. Orphan truncated.
Bad links in lost chain at cluster 57452 corrected.
Lost chain cross-linked at cluster 57453. Orphan truncated.
Lost chain cross-linked at cluster 57454. Orphan truncated.
Lost chain cross-linked at cluster 57455. Orphan truncated.
Bad links in lost chain at cluster 57456 corrected.
Lost chain cross-linked at cluster 57457. Orphan truncated.
Lost chain cross-linked at cluster 57458. Orphan truncated.
Lost chain cross-linked at cluster 57459. Orphan truncated.
Lost chain cross-linked at cluster 57460. Orphan truncated.
Bad links in lost chain at cluster 57461 corrected.
Bad links in lost chain at cluster 57462 corrected.
Bad links in lost chain at cluster 57463 corrected.
Bad links in lost chain at cluster 57464 corrected.
Bad links in lost chain at cluster 57465 corrected.
Bad links in lost chain at cluster 57466 corrected.
Bad links in lost chain at cluster 57467 corrected.
Bad links in lost chain at cluster 57468 corrected.
Bad links in lost chain at cluster 57469 corrected.
Bad links in lost chain at cluster 57470 corrected.
Bad links in lost chain at cluster 57471 corrected.
Bad links in lost chain at cluster 57472 corrected.
Bad links in lost chain at cluster 57473 corrected.
Bad links in lost chain at cluster 57474 corrected.
Bad links in lost chain at cluster 57475 corrected.
Bad links in lost chain at cluster 57476 corrected.
Bad links in lost chain at cluster 57477 corrected.
Bad links in lost chain at cluster 57478 corrected.
Bad links in lost chain at cluster 57479 corrected.
Bad links in lost chain at cluster 57480 corrected.
Bad links in lost chain at cluster 57481 corrected.
Bad links in lost chain at cluster 57482 corrected.
Bad links in lost chain at cluster 57483 corrected.
Bad links in lost chain at cluster 57484 corrected.
Bad links in lost chain at cluster 57485 corrected.
Bad links in lost chain at cluster 57486 corrected.
Bad links in lost chain at cluster 57487 corrected.
Bad links in lost chain at cluster 57488 corrected.
Bad links in lost chain at cluster 57489 corrected.
Bad links in lost chain at cluster 57490 corrected.
Bad links in lost chain at cluster 57491 corrected.
Bad links in lost chain at cluster 57492 corrected.
Bad links in lost chain at cluster 57493 corrected.
Bad links in lost chain at cluster 57494 corrected.
Bad links in lost chain at cluster 57495 corrected.
Bad links in lost chain at cluster 57496 corrected.
Bad links in lost chain at cluster 57497 corrected.
Bad links in lost chain at cluster 57498 corrected.
Bad links in lost chain at cluster 57499 corrected.
Bad links in lost chain at cluster 57500 corrected.
Bad links in lost chain at cluster 57501 corrected.
Bad links in lost chain at cluster 57502 corrected.
Bad links in lost chain at cluster 57503 corrected.
Bad links in lost chain at cluster 57504 corrected.
Bad links in lost chain at cluster 57505 corrected.
Bad links in lost chain at cluster 57506 corrected.
Bad links in lost chain at cluster 57507 corrected.
Bad links in lost chain at cluster 57508 corrected.
Bad links in lost chain at cluster 57509 corrected.
Bad links in lost chain at cluster 57510 corrected.
Bad links in lost chain at cluster 57511 corrected.
Bad links in lost chain at cluster 57512 corrected.
Bad links in lost chain at cluster 57513 corrected.
Bad links in lost chain at cluster 57514 corrected.
Bad links in lost chain at cluster 57515 corrected.
Bad links in lost chain at cluster 57516 corrected.
Bad links in lost chain at cluster 57517 corrected.
Bad links in lost chain at cluster 57518 corrected.
Bad links in lost chain at cluster 57519 corrected.
Bad links in lost chain at cluster 57520 corrected.
Bad links in lost chain at cluster 57521 corrected.
Bad links in lost chain at cluster 57522 corrected.
Bad links in lost chain at cluster 57523 corrected.
Bad links in lost chain at cluster 57524 corrected.
Bad links in lost chain at cluster 57525 corrected.
Bad links in lost chain at cluster 57526 corrected.
Bad links in lost chain at cluster 57527 corrected.
Bad links in lost chain at cluster 57528 corrected.
Bad links in lost chain at cluster 57529 corrected.
Bad links in lost chain at cluster 57530 corrected.
Bad links in lost chain at cluster 57531 corrected.
Bad links in lost chain at cluster 57532 corrected.
Bad links in lost chain at cluster 57533 corrected.
Bad links in lost chain at cluster 57534 corrected.
Bad links in lost chain at cluster 57535 corrected.
Bad links in lost chain at cluster 57536 corrected.
Bad links in lost chain at cluster 57537 corrected.
Bad links in lost chain at cluster 57538 corrected.
Bad links in lost chain at cluster 57539 corrected.
Bad links in lost chain at cluster 57540 corrected.
Bad links in lost chain at cluster 57541 corrected.
Bad links in lost chain at cluster 57542 corrected.
Bad links in lost chain at cluster 57543 corrected.
Bad links in lost chain at cluster 57544 corrected.
Bad links in lost chain at cluster 57545 corrected.
Bad links in lost chain at cluster 57546 corrected.
Bad links in lost chain at cluster 57547 corrected.
Bad links in lost chain at cluster 57548 corrected.
Bad links in lost chain at cluster 57549 corrected.
Bad links in lost chain at cluster 57550 corrected.
Bad links in lost chain at cluster 57551 corrected.
Bad links in lost chain at cluster 57552 corrected.
Bad links in lost chain at cluster 57553 corrected.
Bad links in lost chain at cluster 57554 corrected.
Bad links in lost chain at cluster 57555 corrected.
Bad links in lost chain at cluster 57556 corrected.
Bad links in lost chain at cluster 57557 corrected.
Bad links in lost chain at cluster 57558 corrected.
Bad links in lost chain at cluster 57559 corrected.
Bad links in lost chain at cluster 57560 corrected.
Bad links in lost chain at cluster 57561 corrected.
Bad links in lost chain at cluster 57562 corrected.
Bad links in lost chain at cluster 57563 corrected.
Bad links in lost chain at cluster 57564 corrected.
Bad links in lost chain at cluster 57565 corrected.
Bad links in lost chain at cluster 57566 corrected.
Bad links in lost chain at cluster 57567 corrected.
Bad links in lost chain at cluster 57568 corrected.
Bad links in lost chain at cluster 57569 corrected.
Bad links in lost chain at cluster 57570 corrected.
Bad links in lost chain at cluster 57571 corrected.
Bad links in lost chain at cluster 57572 corrected.
Bad links in lost chain at cluster 57573 corrected.
Bad links in lost chain at cluster 57574 corrected.
Bad links in lost chain at cluster 57575 corrected.
Bad links in lost chain at cluster 57576 corrected.
Bad links in lost chain at cluster 57577 corrected.
Bad links in lost chain at cluster 57578 corrected.
Bad links in lost chain at cluster 57579 corrected.
Bad links in lost chain at cluster 57580 corrected.
Bad links in lost chain at cluster 57581 corrected.
Bad links in lost chain at cluster 57582 corrected.
Bad links in lost chain at cluster 57583 corrected.
Bad links in lost chain at cluster 57584 corrected.
Bad links in lost chain at cluster 57585 corrected.
Bad links in lost chain at cluster 57586 corrected.
Bad links in lost chain at cluster 57587 corrected.
Bad links in lost chain at cluster 57588 corrected.
Bad links in lost chain at cluster 57589 corrected.
Bad links in lost chain at cluster 57590 corrected.
Bad links in lost chain at cluster 57591 corrected.
Bad links in lost chain at cluster 57592 corrected.
Bad links in lost chain at cluster 57593 corrected.
Bad links in lost chain at cluster 57594 corrected.
Bad links in lost chain at cluster 57595 corrected.
Bad links in lost chain at cluster 57596 corrected.
Bad links in lost chain at cluster 57597 corrected.
Bad links in lost chain at cluster 57598 corrected.
Bad links in lost chain at cluster 57599 corrected.
Bad links in lost chain at cluster 58377 corrected.
Bad links in lost chain at cluster 58378 corrected.
Bad links in lost chain at cluster 58379 corrected.
Lost chain cross-linked at cluster 58380. Orphan truncated.
Bad links in lost chain at cluster 58381 corrected.
Lost chain cross-linked at cluster 58382. Orphan truncated.
Lost chain cross-linked at cluster 58384. Orphan truncated.
Lost chain cross-linked at cluster 58385. Orphan truncated.
Lost chain cross-linked at cluster 58386. Orphan truncated.
Lost chain cross-linked at cluster 58387. Orphan truncated.
Bad links in lost chain at cluster 58388 corrected.
Bad links in lost chain at cluster 58389 corrected.
Bad links in lost chain at cluster 58390 corrected.
Lost chain cross-linked at cluster 58391. Orphan truncated.
Lost chain cross-linked at cluster 58392. Orphan truncated.
Bad links in lost chain at cluster 58393 corrected.
Bad links in lost chain at cluster 58394 corrected.
Lost chain cross-linked at cluster 58395. Orphan truncated.
Lost chain cross-linked at cluster 58396. Orphan truncated.
Lost chain cross-linked at cluster 58397. Orphan truncated.
Lost chain cross-linked at cluster 58398. Orphan truncated.
Bad links in lost chain at cluster 58400 corrected.
Lost chain cross-linked at cluster 58401. Orphan truncated.
Bad links in lost chain at cluster 58405 corrected.
Bad links in lost chain at cluster 58406 corrected.
Bad links in lost chain at cluster 58407 corrected.
Bad links in lost chain at cluster 58409 corrected.
Lost chain cross-linked at cluster 58411. Orphan truncated.
Bad links in lost chain at cluster 58412 corrected.
Bad links in lost chain at cluster 58413 corrected.
Bad links in lost chain at cluster 58414 corrected.
Bad links in lost chain at cluster 58415 corrected.
Bad links in lost chain at cluster 58416 corrected.
Lost chain cross-linked at cluster 58417. Orphan truncated.
Bad links in lost chain at cluster 58418 corrected.
Bad links in lost chain at cluster 58419 corrected.
Bad links in lost chain at cluster 58420 corrected.
Lost chain cross-linked at cluster 58421. Orphan truncated.
Bad links in lost chain at cluster 58422 corrected.
Lost chain cross-linked at cluster 58424. Orphan truncated.
Bad links in lost chain at cluster 58425 corrected.
Lost chain cross-linked at cluster 58426. Orphan truncated.
Bad links in lost chain at cluster 58427 corrected.
Bad links in lost chain at cluster 58428 corrected.
Bad links in lost chain at cluster 58429 corrected.
Bad links in lost chain at cluster 58430 corrected.
Lost chain cross-linked at cluster 58434. Orphan truncated.
Bad links in lost chain at cluster 58436 corrected.
Bad links in lost chain at cluster 58437 corrected.
Lost chain cross-linked at cluster 58438. Orphan truncated.
Bad links in lost chain at cluster 58439 corrected.
Bad links in lost chain at cluster 58440 corrected.
Bad links in lost chain at cluster 58441 corrected.
Lost chain cross-linked at cluster 58443. Orphan truncated.
Lost chain cross-linked at cluster 58444. Orphan truncated.
Lost chain cross-linked at cluster 58445. Orphan truncated.
Lost chain cross-linked at cluster 58446. Orphan truncated.
Lost chain cross-linked at cluster 58450. Orphan truncated.
Bad links in lost chain at cluster 58451 corrected.
Lost chain cross-linked at cluster 58452. Orphan truncated.
Lost chain cross-linked at cluster 58453. Orphan truncated.
Lost chain cross-linked at cluster 58454. Orphan truncated.
Lost chain cross-linked at cluster 58455. Orphan truncated.
Lost chain cross-linked at cluster 58456. Orphan truncated.
Lost chain cross-linked at cluster 58457. Orphan truncated.
Lost chain cross-linked at cluster 58458. Orphan truncated.
Lost chain cross-linked at cluster 58459. Orphan truncated.
Bad links in lost chain at cluster 58460 corrected.
Bad links in lost chain at cluster 58461 corrected.
Bad links in lost chain at cluster 58462 corrected.
Bad links in lost chain at cluster 58463 corrected.
Bad links in lost chain at cluster 58464 corrected.
Bad links in lost chain at cluster 58465 corrected.
Bad links in lost chain at cluster 58466 corrected.
Lost chain cross-linked at cluster 58467. Orphan truncated.
Lost chain cross-linked at cluster 58468. Orphan truncated.
Lost chain cross-linked at cluster 58469. Orphan truncated.
Lost chain cross-linked at cluster 58470. Orphan truncated.
Lost chain cross-linked at cluster 58471. Orphan truncated.
Lost chain cross-linked at cluster 58472. Orphan truncated.
Lost chain cross-linked at cluster 58473. Orphan truncated.
Lost chain cross-linked at cluster 58474. Orphan truncated.
Lost chain cross-linked at cluster 58475. Orphan truncated.
Lost chain cross-linked at cluster 58476. Orphan truncated.
Lost chain cross-linked at cluster 58477. Orphan truncated.
Lost chain cross-linked at cluster 58478. Orphan truncated.
Lost chain cross-linked at cluster 58479. Orphan truncated.
Lost chain cross-linked at cluster 58480. Orphan truncated.
Lost chain cross-linked at cluster 58481. Orphan truncated.
Lost chain cross-linked at cluster 58482. Orphan truncated.
Lost chain cross-linked at cluster 58483. Orphan truncated.
Lost chain cross-linked at cluster 58484. Orphan truncated.
Bad links in lost chain at cluster 58485 corrected.
Lost chain cross-linked at cluster 58486. Orphan truncated.
Lost chain cross-linked at cluster 58487. Orphan truncated.
Lost chain cross-linked at cluster 58488. Orphan truncated.
Lost chain cross-linked at cluster 58489. Orphan truncated.
Lost chain cross-linked at cluster 58490. Orphan truncated.
Bad links in lost chain at cluster 58491 corrected.
Lost chain cross-linked at cluster 58492. Orphan truncated.
Lost chain cross-linked at cluster 58493. Orphan truncated.
Lost chain cross-linked at cluster 58494. Orphan truncated.
Lost chain cross-linked at cluster 58495. Orphan truncated.
Lost chain cross-linked at cluster 58496. Orphan truncated.
Lost chain cross-linked at cluster 58497. Orphan truncated.
Lost chain cross-linked at cluster 58498. Orphan truncated.
Lost chain cross-linked at cluster 58501. Orphan truncated.
Lost chain cross-linked at cluster 58502. Orphan truncated.
Lost chain cross-linked at cluster 58505. Orphan truncated.
Lost chain cross-linked at cluster 58506. Orphan truncated.
Bad links in lost chain at cluster 58507 corrected.
Bad links in lost chain at cluster 58508 corrected.
Lost chain cross-linked at cluster 58509. Orphan truncated.
Lost chain cross-linked at cluster 58510. Orphan truncated.
Lost chain cross-linked at cluster 58511. Orphan truncated.
Lost chain cross-linked at cluster 58512. Orphan truncated.
Lost chain cross-linked at cluster 58513. Orphan truncated.
Lost chain cross-linked at cluster 58514. Orphan truncated.
Lost chain cross-linked at cluster 58515. Orphan truncated.
Lost chain cross-linked at cluster 58516. Orphan truncated.
Lost chain cross-linked at cluster 58517. Orphan truncated.
Lost chain cross-linked at cluster 58518. Orphan truncated.
Lost chain cross-linked at cluster 58519. Orphan truncated.
Lost chain cross-linked at cluster 58520. Orphan truncated.
Lost chain cross-linked at cluster 58521. Orphan truncated.
Lost chain cross-linked at cluster 58522. Orphan truncated.
Lost chain cross-linked at cluster 58523. Orphan truncated.
Lost chain cross-linked at cluster 58524. Orphan truncated.
Lost chain cross-linked at cluster 58525. Orphan truncated.
Lost chain cross-linked at cluster 58526. Orphan truncated.
Bad links in lost chain at cluster 58527 corrected.
Bad links in lost chain at cluster 58528 corrected.
Lost chain cross-linked at cluster 58529. Orphan truncated.
Lost chain cross-linked at cluster 58530. Orphan truncated.
Bad links in lost chain at cluster 58531 corrected.
Bad links in lost chain at cluster 58532 corrected.
Lost chain cross-linked at cluster 58533. Orphan truncated.
Lost chain cross-linked at cluster 58534. Orphan truncated.
Bad links in lost chain at cluster 58535 corrected.
Bad links in lost chain at cluster 58536 corrected.
Lost chain cross-linked at cluster 58537. Orphan truncated.
Lost chain cross-linked at cluster 58538. Orphan truncated.
Bad links in lost chain at cluster 58539 corrected.
Bad links in lost chain at cluster 58540 corrected.
Lost chain cross-linked at cluster 58541. Orphan truncated.
Lost chain cross-linked at cluster 58542. Orphan truncated.
Bad links in lost chain at cluster 58543 corrected.
Bad links in lost chain at cluster 58544 corrected.
Bad links in lost chain at cluster 58545 corrected.
Bad links in lost chain at cluster 58546 corrected.
Bad links in lost chain at cluster 58547 corrected.
Bad links in lost chain at cluster 58548 corrected.
Bad links in lost chain at cluster 58549 corrected.
Bad links in lost chain at cluster 58550 corrected.
Bad links in lost chain at cluster 58551 corrected.
Bad links in lost chain at cluster 58552 corrected.
Bad links in lost chain at cluster 58553 corrected.
Bad links in lost chain at cluster 58554 corrected.
Bad links in lost chain at cluster 58555 corrected.
Bad links in lost chain at cluster 58556 corrected.
Bad links in lost chain at cluster 58557 corrected.
Bad links in lost chain at cluster 58558 corrected.
Lost chain cross-linked at cluster 58559. Orphan truncated.
Lost chain cross-linked at cluster 58560. Orphan truncated.
Lost chain cross-linked at cluster 58623. Orphan truncated.
Lost chain cross-linked at cluster 58624. Orphan truncated.
Lost chain cross-linked at cluster 58625. Orphan truncated.
Lost chain cross-linked at cluster 58626. Orphan truncated.
Lost chain cross-linked at cluster 58627. Orphan truncated.
Lost chain cross-linked at cluster 58628. Orphan truncated.
Lost chain cross-linked at cluster 58629. Orphan truncated.
Lost chain cross-linked at cluster 58630. Orphan truncated.
Lost chain cross-linked at cluster 58631. Orphan truncated.
Convert lost chains to files (Y/N)? Yes
3170304 bytes in 432 recovered files.
Windows has made corrections to the file system.

257400832 bytes total disk space.
249856 bytes in 5 hidden files.
323584 bytes in 70 folders.
132337664 bytes in 1150 files.
124489728 bytes available on disk.

4096 bytes in each allocation unit.
62842 total allocation units on disk.
30393 allocation units available on disk.
Checking file system on E:
The type of the file system is FAT.

The volume is dirty.
Volume Serial Number is 1103-221F
Windows has checked the file system and found no problems.

257400832 bytes total disk space.
36864 bytes in 5 hidden files.
98304 bytes in 3 folders.
241516544 bytes in 1634 files.
15749120 bytes available on disk.

4096 bytes in each allocation unit.
62842 total allocation units on disk.
3845 allocation units available on disk.

ComboFix 07-12-21.4 - Hman 2007-12-29 0:26:24.1 - NTFSx86
Running from: E:\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\Helper
C:\Program Files\Helper\superfinderusa.dll
C:\WINDOWS\mrofinu1000512.exe
C:\WINDOWS\mrofinu1239.exe
C:\WINDOWS\system32\drivers\fad.sys
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\system32\regsvr32.dll
C:\WINDOWS\system32\xpdx.sys

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
——-\LEGACY_FAD
——-\xpdx


((((((((((((((((((((((((( Files Created from 2007-11-28 to 2007-12-29 )))))))))))))))))))))))))))))))
.

2007-12-29 00:21 . 2007-12-29 00:21 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2007-12-29 00:21 . 2007-12-29 00:21 1,409 –a—— C:\WINDOWS\QTFont.for
2007-12-25 13:19 . 2007-12-25 13:19 d——– C:\Documents and Settings\Administrator.HAROLD\.java
2007-12-25 13:18 . 2007-12-25 13:18 d——– C:\WINDOWS\SYSTEM32\Kaspersky Lab
2007-12-25 13:18 . 2007-12-25 13:18 d——– C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-12-24 23:45 . 2007-12-24 23:45 d——– C:\Documents and Settings\Administrator.HAROLD\Application Data\Aladdin Systems
2007-12-24 10:50 . 2007-12-24 10:50 d——– C:\Documents and Settings\Administrator.HAROLD\Application Data\Lavasoft
2007-12-23 18:21 . 2007-12-23 18:21 2 ——— C:\550759495
2007-12-23 18:20 . 2007-12-23 18:20 d——– C:\WINDOWS\SYSTEM32\ardCo17
2007-12-23 18:20 . 2007-12-23 18:20 d——– C:\TEMP\cEeer12
2007-12-23 18:20 . 2007-12-23 18:20 57,856 –a—— C:\tsqfy.exe
2007-12-23 18:20 . 2007-12-23 18:20 53,760 –a—— C:\fych.exe
2007-12-04 20:30 . 2004-08-04 02:07 59,264 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\USBAUDIO.sys
2007-12-04 20:29 . 2004-10-08 06:54 1,206,272 -ra—— C:\WINDOWS\SYSTEM32\DRIVERS\LVSVF2.sys
2007-12-04 20:29 . 2003-02-20 23:42 348,160 -ra—— C:\WINDOWS\SYSTEM\msvcr71.dll
2007-12-04 20:29 . 2004-10-08 06:59 326,656 -ra—— C:\WINDOWS\SYSTEM32\DRIVERS\Camdrl.sys
2007-12-04 20:29 . 2004-10-08 06:58 139,264 -ra—— C:\WINDOWS\SYSTEM\CamExL20.dll
2007-12-04 20:29 . 2004-10-08 06:59 90,112 -ra—— C:\WINDOWS\SYSTEM\CamExL20.ax
2007-12-04 20:27 . 2007-12-04 20:27 d——– C:\Program Files\Common Files\FotoWire
2007-12-04 20:27 . 2007-12-04 20:27 d——– C:\Documents and Settings\Hman\Application Data\FotoWire
2007-12-04 20:23 . 2004-10-08 12:46 53,248 -ra—— C:\WINDOWS\SYSTEM32\InstMed.exe
2007-12-04 20:17 . 2005-01-18 14:23 628,736 –a—— C:\WINDOWS\SYSTEM32\ltocx12n.ocx
2007-12-04 20:17 . 2005-01-18 17:35 462,848 –a—— C:\WINDOWS\SYSTEM32\LCamCpl.dll
2007-12-04 20:17 . 2005-01-18 17:36 282,624 –a—— C:\WINDOWS\SYSTEM32\camcpl.cpl
2007-12-04 20:17 . 2005-01-18 14:23 215,552 –a—— C:\WINDOWS\SYSTEM32\Lvkrn12n.dll
2007-12-04 20:17 . 2005-01-18 14:23 192,512 –a—— C:\WINDOWS\SYSTEM32\ltscr12n.ocx
2007-12-04 20:17 . 2003-06-09 19:39 29,795 –a—— C:\WINDOWS\SYSTEM32\ITIG726.acm
2007-11-30 23:57 . 2007-11-30 23:57 317,616 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\srtspl.sys
2007-11-30 23:57 . 2007-11-30 23:57 279,088 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\srtsp.sys
2007-11-30 23:57 . 2007-11-30 23:57 43,696 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\srtspx.sys
2007-11-30 23:57 . 2007-11-30 23:57 10,549 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\srtspx.cat
2007-11-30 23:57 . 2007-11-30 23:57 10,549 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\srtspl.cat
2007-11-30 23:57 . 2007-11-30 23:57 10,545 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\srtsp.cat
2007-11-30 23:57 . 2007-11-30 23:57 1,430 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\srtspl.inf
2007-11-30 23:57 . 2007-11-30 23:57 1,421 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\srtspx.inf
2007-11-30 23:57 . 2007-11-30 23:57 1,415 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\srtsp.inf

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-29 05:39 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2007-12-26 22:15 ——— d—–w C:\Program Files\vol_toolbar
2007-12-26 22:15 ——— d—–w C:\Program Files\Verizon
2007-12-25 15:17 ——— d—–w C:\Program Files\Trend Micro
2007-12-25 11:28 ——— d—–w C:\Documents and Settings\All Users\Application Data\Symantec
2007-12-23 16:39 ——— d—–w C:\Documents and Settings\Hman\Application Data\Skype
2007-12-23 00:00 ——— d—–w C:\Documents and Settings\All Users\Application Data\SiteAdvisor
2007-12-20 21:49 ——— d—–w C:\Program Files\SiteAdvisor
2007-12-05 23:19 805 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2007-12-05 23:19 123,952 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2007-12-05 23:19 10,740 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2007-12-05 23:19 ——— d—–w C:\Program Files\Symantec
2007-12-05 01:27 ——— d—–w C:\Program Files\Logitech
2007-12-05 01:21 ——— d—–w C:\Program Files\Common Files\Logitech
2007-12-05 01:16 81,920 ——r C:\WINDOWS\bwUnin-6.1.4.68-8876480L.exe
2007-12-05 01:16 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-11-16 21:59 ——— d—–w C:\Program Files\Norton Internet Security
2007-11-13 10:25 20,480 —-a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-11-09 23:04 ——— d—–w C:\Documents and Settings\Hman\Application Data\Lavasoft
2007-11-09 23:02 ——— d—–w C:\Program Files\Lavasoft
2007-11-09 22:47 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
2007-11-08 23:28 ——— d—–w C:\Program Files\HP
2007-11-07 21:19 ——— d—–w C:\Documents and Settings\Hman\Application Data\vol_toolbar
2007-11-06 21:38 ——— d—–w C:\Program Files\iTunes
2007-11-06 21:37 ——— d—–w C:\Program Files\iPod
2007-11-06 21:32 ——— d—–w C:\Program Files\QuickTime
2007-11-04 13:26 ——— d—–w C:\Documents and Settings\All Users\Application Data\Motive
2007-11-03 21:02 ——— d—–w C:\Documents and Settings\Hman\Application Data\Motive
2007-11-03 20:47 ——— d—–w C:\Documents and Settings\Hman\Application Data\Verizon
2007-11-03 20:47 ——— d—–w C:\Documents and Settings\All Users\Application Data\Verizon
2007-11-03 20:46 ——— d—–w C:\Program Files\Common Files\Motive
2007-11-03 20:16 ——— d—–w C:\Program Files\Comcast Web Controls
2007-10-31 00:55 39,856 —-a-w C:\WINDOWS\system32\drivers\symids.sys
2007-10-31 00:55 37,936 —-a-w C:\WINDOWS\system32\drivers\symndisv.sys
2007-10-31 00:55 35,120 —-a-w C:\WINDOWS\system32\drivers\symndis.sys
2007-10-31 00:55 27,696 —-a-w C:\WINDOWS\system32\drivers\symredrv.sys
2007-10-31 00:55 191,536 —-a-w C:\WINDOWS\system32\drivers\symtdi.sys
2007-10-31 00:55 145,968 —-a-w C:\WINDOWS\system32\drivers\symfw.sys
2007-10-31 00:55 12,848 —-a-w C:\WINDOWS\system32\drivers\symdns.sys
2007-10-31 00:24 12,963 —-a-w C:\WINDOWS\system32\drivers\SymRedir.cat
2007-10-31 00:24 1,358 —-a-w C:\WINDOWS\system32\drivers\SymRedir.inf
2007-10-30 22:13 ——— d—–w C:\Documents and Settings\All Users\Application Data\Lavasoft
2006-04-18 21:11 87,072 -c—-w C:\Documents and Settings\Hman\Application Data\GDIPFONTCACHEV1.DAT
2003-12-21 16:31 771,924 -c–a-w C:\Program Files\setup.exe
2003-08-13 12:00 5,554 —-a-w C:\Program Files\lbdata.stt
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{423a0a67-20c5-4b79-a4b7-2456e79acf5a}]
2007-04-11 16:19 1297432 –a—— C:\Program Files\MySpace_Customizer\tbMyS1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{B2C4B923-9C8B-4A7B-B2E5-2F0BC4F024DE}
{423A0A67-20C5-4B79-A4B7-2456E79ACF5A}
{90222687-F593-4738-B738-FBEE9C7B26DF}

[HKEY_CLASSES_ROOT\clsid\{423a0a67-20c5-4b79-a4b7-2456e79acf5a}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{423A0A67-20C5-4B79-A4B7-2456E79ACF5A}"= C:\Program Files\MySpace_Customizer\tbMyS1.dll [2007-04-11 16:19 1297432]
"{4E7BD74F-2B8D-469E-8CB0-AB60BB9AAE22}"= C:\PROGRA~1\VOL_TO~1\VOL_TO~1.DLL [2007-05-25 08:15 1904128]

[HKEY_CLASSES_ROOT\clsid\{423a0a67-20c5-4b79-a4b7-2456e79acf5a}]

[HKEY_CLASSES_ROOT\clsid\{4e7bd74f-2b8d-469e-8cb0-ab60bb9aae22}]
[HKEY_CLASSES_ROOT\vol_toolbar.VOL_TOOLBAR]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="RUNDLL32.exe" [2004-08-04 02:56 C:\WINDOWS\SYSTEM32\rundll32.exe]
"nwiz"="nwiz.exe" [2003-10-06 14:16 C:\WINDOWS\SYSTEM32\nwiz.exe]
"SiteAdvisor"="C:\Program Files\SiteAdvisor\6253\SiteAdv.exe" [2006-10-02 14:09]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-06-04 21:05]
"osCheck"="C:\Program Files\Norton Internet Security\osCheck.exe" [2007-06-26 00:00]
"Verizon_McciTrayApp"="C:\Program Files\Verizon\McciTrayApp.exe" [2007-06-06 18:52]
"QuickTime Task"="C:\PROGRAM FILES\QUICKTIME\QTTASK.exe" [2007-10-19 20:16]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-11-28 19:51]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoBandCustomize"= 0 (0x0)
"NoMovingBands"= 0 (0x0)
"NoCloseDragDropBands"= 0 (0x0)
"NoToolbarsOnTaskbar"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
C:\Program Files\Citrix\GoToAssist\480\G2AWinLogon.dll 2007-10-18 18:17 10792 C:\Program Files\Citrix\GoToAssist\480\g2awinlogon.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ :\WINDOW

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=C:\WINDOWS\pss\Digital Line Detect.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HotSync Manager.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HotSync Manager.lnk
backup=C:\WINDOWS\pss\HotSync Manager.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk
backup=C:\WINDOWS\pss\HP Image Zone Fast Start.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^MA111 Configuration Utility.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\MA111 Configuration Utility.lnk
backup=C:\WINDOWS\pss\MA111 Configuration Utility.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office Fast Start.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office Fast Start.lnk
backup=C:\WINDOWS\pss\Microsoft Office Fast Start.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office Find Fast Indexer.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office Find Fast Indexer.lnk
backup=C:\WINDOWS\pss\Microsoft Office Find Fast Indexer.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office Shortcut Bar.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office Shortcut Bar.lnk
backup=C:\WINDOWS\pss\Microsoft Office Shortcut Bar.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Verizon Online Support Center.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Verizon Online Support Center.lnk
backup=C:\WINDOWS\pss\Verizon Online Support Center.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Hman^Start Menu^Programs^Startup^Avvenu v1.0.lnk]
path=C:\Documents and Settings\Hman\Start Menu\Programs\Startup\Avvenu v1.0.lnk
backup=C:\WINDOWS\pss\Avvenu v1.0.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdaptecDirectCD]
2003-09-06 09:26 684032 –a—— C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AIM]
C:\PROGRA~1\AIM\aim.exe -cnetwait.odl

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CursorXP]
2003-03-01 16:40 125440 –a—— C:\Program Files\CursorXP\CursorXP.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDSentry]
2002-08-14 18:22 28672 -ra—— C:\WINDOWS\System32\DSentry.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2007-05-08 15:24 54840 –a—— C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2007-11-02 18:36 267048 –a—— C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]
????

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Utility]
Logi_MwX.Exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
2002-07-16 07:21 28672 –a—— C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Motive SmartBridge]
C:\PROGRA~1\VERIZO~1\SUPPOR~1\SMARTB~1\MotiveSB.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\PROGRAM FILES\QUICKTIME\QTTASK.EXE -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Run]
????

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
C:\Program Files\Common Files\Real\Update_OB\realsched.exe -osboot

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ViewMgr]
2004-11-10 23:15 111816 –a—— C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
2006-10-18 20:05 204288 ——— C:\Program Files\Windows Media Player\WMPNSCFG.exe


*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder
"2007-12-25 17:07:12 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-12-22 13:33:56 C:\WINDOWS\Tasks\Norton Internet Security - Run Full System Scan - Hman.job"
- C:\Program Files\Norton Internet Security\Norton AntiVirus\Navw32.exeh/TASK:
.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-29 00:41:42
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

**************************************************************************
.
Completion time: 2007-12-29 0:47:49 - machine was rebooted
.
2007-12-11 22:30:58 — E O F —
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:01:34 AM, on 12/29/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\SiteAdvisor\6253\SAService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Verizon\McciTrayApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://63.138.132.82/exchange
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dellnet.com/
R3 - URLSearchHook: MySpace Customizer Toolbar - {423a0a67-20c5-4b79-a4b7-2456e79acf5a} - C:\Program Files\MySpace_Customizer\tbMyS1.dll
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://my.yahoo.com/p/d.html?v"); (C:\Documents and Settings\HMAN\Application Data\Mozilla\Profiles\default\5sih44uv.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_02.src"); (C:\Documents and Settings\HMAN\Application Data\Mozilla\Profiles\default\5sih44uv.slt\prefs.js)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.7\NppBho.dll
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: MySpace Customizer Toolbar - {423a0a67-20c5-4b79-a4b7-2456e79acf5a} - C:\Program Files\MySpace_Customizer\tbMyS1.dll
O3 - Toolbar: (no name) - {B2C4B923-9C8B-4A7B-B2E5-2F0BC4F024DE} - (no file)
O3 - Toolbar: MySpace Customizer Toolbar - {423a0a67-20c5-4b79-a4b7-2456e79acf5a} - C:\Program Files\MySpace_Customizer\tbMyS1.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.7\UIBHO.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Verizon_McciTrayApp] C:\Program Files\Verizon\McciTrayApp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\PROGRAM FILES\QUICKTIME\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: CachePal - {5F4A4622-8370-440e-88CC-CA2256D1A08A} - C:\WINDOWS\System32\cachepal.exe
O9 - Extra 'Tools' menuitem: CachePal - {5F4A4622-8370-440e-88CC-CA2256D1A08A} - C:\WINDOWS\System32\cachepal.exe
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted IP range: http://192.168.1.1
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://activatemyfios.verizon.net/sdcCommo…IOS/tgctlcm.cab
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/u…can_unicode.cab
O16 - DPF: {13EC55CF-D993-475B-9ACA-F4A384957956} (Controller Class) - https://www.windowsonecare.com/install/cli/…nSSWebAgent.CAB
O16 - DPF: {31E68DE2-5548-4B23-88F0-C51E6A0F695E} (Microsoft PID Sniffer) - https://support.microsoft.com/OAS/ActiveX/odc.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1143671063531
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.napster.com/client/isetup.cab
O16 - DPF: {94B82441-A413-4E43-8422-D49930E69764} (TLIEFlashObj Class) - https://webchat.dell.com/Media/VisitorChat/TLIEFlash.CAB
O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {E856B973-45FD-4559-8F82-EAB539144667} (Dell PC Checkup Installer Control) - http://pccheckup.dellfix.com/rel/35/install/gtdownde.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\480\G2AWinLogon.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6253\SAService.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

–
End of file - 9552 bytes

ComboFix 07-12-21.4 - Hman 2007-12-29 11:00:35.2 - NTFSx86
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: E:\CFScript.txt
* Created a new restore point

FILE
C:\550759495
C:\fych.exe
C:\Program Files\lbdata.stt
C:\Program Files\setup.exe
C:\tsqfy.exe
C:\WINDOWS\bwUnin-6.1.4.68-8876480L.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\550759495
C:\fych.exe
C:\Program Files\lbdata.stt
C:\Program Files\setup.exe
C:\Program Files\Viewpoint
C:\Program Files\Viewpoint\Viewpoint Manager\NotifyData\header.gif
C:\Program Files\Viewpoint\Viewpoint Manager\NotifyData\no.gif
C:\Program Files\Viewpoint\Viewpoint Manager\NotifyData\options.ini
C:\Program Files\Viewpoint\Viewpoint Manager\NotifyData\updates.html
C:\Program Files\Viewpoint\Viewpoint Manager\NotifyData\yes.gif
C:\Program Files\Viewpoint\Viewpoint Manager\Read_Me.txt
C:\Program Files\Viewpoint\Viewpoint Manager\VETScriptInterpreter.dll
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCP.cpl
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\s.gif
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vm_header_av.gif
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vm_header_cp.gif
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vm_header_up.gif
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vm_inner_bg.gif
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vm_inner_bottom.gif
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vm_tab_bg.gif
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vm_tab1_off.gif
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vm_tab1_on.gif
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vm_tab2_off.gif
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vm_tab2_on.gif
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vwpt_logo.gif
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\options.ini
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\viewpoint.ico
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\vmctrl.html
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgrCore.dll
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgrInstaller.exe
C:\TEMP\cEeer12
C:\tsqfy.exe
C:\WINDOWS\bwUnin-6.1.4.68-8876480L.exe
C:\WINDOWS\SYSTEM32\ardCo17
F:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2007-11-28 to 2007-12-29 )))))))))))))))))))))))))))))))
.

2007-12-29 00:21 . 2007-12-29 00:21 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2007-12-29 00:21 . 2007-12-29 00:21 1,409 –a—— C:\WINDOWS\QTFont.for
2007-12-25 13:19 . 2007-12-25 13:19 d——– C:\Documents and Settings\Administrator.HAROLD\.java
2007-12-25 13:18 . 2007-12-25 13:18 d——– C:\WINDOWS\SYSTEM32\Kaspersky Lab
2007-12-25 13:18 . 2007-12-25 13:18 d——– C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-12-24 23:45 . 2007-12-24 23:45 d——– C:\Documents and Settings\Administrator.HAROLD\Application Data\Aladdin Systems
2007-12-24 10:50 . 2007-12-24 10:50 d——– C:\Documents and Settings\Administrator.HAROLD\Application Data\Lavasoft
2007-12-04 20:30 . 2004-08-04 02:07 59,264 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\USBAUDIO.sys
2007-12-04 20:29 . 2004-10-08 06:54 1,206,272 -ra—— C:\WINDOWS\SYSTEM32\DRIVERS\LVSVF2.sys
2007-12-04 20:29 . 2003-02-20 23:42 348,160 -ra—— C:\WINDOWS\SYSTEM\msvcr71.dll
2007-12-04 20:29 . 2004-10-08 06:59 326,656 -ra—— C:\WINDOWS\SYSTEM32\DRIVERS\Camdrl.sys
2007-12-04 20:29 . 2004-10-08 06:58 139,264 -ra—— C:\WINDOWS\SYSTEM\CamExL20.dll
2007-12-04 20:29 . 2004-10-08 06:59 90,112 -ra—— C:\WINDOWS\SYSTEM\CamExL20.ax
2007-12-04 20:27 . 2007-12-04 20:27 d——– C:\Program Files\Common Files\FotoWire
2007-12-04 20:27 . 2007-12-04 20:27 d——– C:\Documents and Settings\Hman\Application Data\FotoWire
2007-12-04 20:23 . 2004-10-08 12:46 53,248 -ra—— C:\WINDOWS\SYSTEM32\InstMed.exe
2007-12-04 20:17 . 2005-01-18 14:23 628,736 –a—— C:\WINDOWS\SYSTEM32\ltocx12n.ocx
2007-12-04 20:17 . 2005-01-18 17:35 462,848 –a—— C:\WINDOWS\SYSTEM32\LCamCpl.dll
2007-12-04 20:17 . 2005-01-18 17:36 282,624 –a—— C:\WINDOWS\SYSTEM32\camcpl.cpl
2007-12-04 20:17 . 2005-01-18 14:23 215,552 –a—— C:\WINDOWS\SYSTEM32\Lvkrn12n.dll
2007-12-04 20:17 . 2005-01-18 14:23 192,512 –a—— C:\WINDOWS\SYSTEM32\ltscr12n.ocx
2007-12-04 20:17 . 2003-06-09 19:39 29,795 –a—— C:\WINDOWS\SYSTEM32\ITIG726.acm
2007-11-30 23:57 . 2007-11-30 23:57 317,616 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\srtspl.sys
2007-11-30 23:57 . 2007-11-30 23:57 279,088 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\srtsp.sys
2007-11-30 23:57 . 2007-11-30 23:57 43,696 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\srtspx.sys
2007-11-30 23:57 . 2007-11-30 23:57 10,549 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\srtspx.cat
2007-11-30 23:57 . 2007-11-30 23:57 10,549 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\srtspl.cat
2007-11-30 23:57 . 2007-11-30 23:57 10,545 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\srtsp.cat
2007-11-30 23:57 . 2007-11-30 23:57 1,430 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\srtspl.inf
2007-11-30 23:57 . 2007-11-30 23:57 1,421 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\srtspx.inf
2007-11-30 23:57 . 2007-11-30 23:57 1,415 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\srtsp.inf

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-29 05:39 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2007-12-26 22:15 ——— d—–w C:\Program Files\vol_toolbar
2007-12-26 22:15 ——— d—–w C:\Program Files\Verizon
2007-12-25 15:17 ——— d—–w C:\Program Files\Trend Micro
2007-12-25 11:28 ——— d—–w C:\Documents and Settings\All Users\Application Data\Symantec
2007-12-23 16:39 ——— d—–w C:\Documents and Settings\Hman\Application Data\Skype
2007-12-23 00:00 ——— d—–w C:\Documents and Settings\All Users\Application Data\SiteAdvisor
2007-12-20 21:49 ——— d—–w C:\Program Files\SiteAdvisor
2007-12-05 23:19 805 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2007-12-05 23:19 60,800 —-a-w C:\WINDOWS\SYSTEM32\S32EVNT1.DLL
2007-12-05 23:19 123,952 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2007-12-05 23:19 10,740 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2007-12-05 23:19 ——— d—–w C:\Program Files\Symantec
2007-12-05 01:27 ——— d—–w C:\Program Files\Logitech
2007-12-05 01:21 ——— d—–w C:\Program Files\Common Files\Logitech
2007-12-05 01:16 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-11-16 21:59 ——— d—–w C:\Program Files\Norton Internet Security
2007-11-13 10:25 20,480 —-a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-11-09 23:04 ——— d—–w C:\Documents and Settings\Hman\Application Data\Lavasoft
2007-11-09 23:02 ——— d—–w C:\Program Files\Lavasoft
2007-11-09 22:47 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
2007-11-08 23:28 ——— d—–w C:\Program Files\HP
2007-11-07 21:19 ——— d—–w C:\Documents and Settings\Hman\Application Data\vol_toolbar
2007-11-06 21:38 ——— d—–w C:\Program Files\iTunes
2007-11-06 21:37 ——— d—–w C:\Program Files\iPod
2007-11-06 21:32 ——— d—–w C:\Program Files\QuickTime
2007-11-04 13:26 ——— d—–w C:\Documents and Settings\All Users\Application Data\Motive
2007-11-03 21:02 ——— d—–w C:\Documents and Settings\Hman\Application Data\Motive
2007-11-03 20:47 ——— d—–w C:\Documents and Settings\Hman\Application Data\Verizon
2007-11-03 20:47 ——— d—–w C:\Documents and Settings\All Users\Application Data\Verizon
2007-11-03 20:46 ——— d—–w C:\Program Files\Common Files\Motive
2007-11-03 20:16 ——— d—–w C:\Program Files\Comcast Web Controls
2007-10-31 00:55 625,032 —-a-w C:\WINDOWS\SYSTEM32\SymNeti.dll
2007-10-31 00:55 39,856 —-a-w C:\WINDOWS\system32\drivers\symids.sys
2007-10-31 00:55 37,936 —-a-w C:\WINDOWS\system32\drivers\symndisv.sys
2007-10-31 00:55 35,120 —-a-w C:\WINDOWS\system32\drivers\symndis.sys
2007-10-31 00:55 27,696 —-a-w C:\WINDOWS\system32\drivers\symredrv.sys
2007-10-31 00:55 242,056 —-a-w C:\WINDOWS\SYSTEM32\SymRedir.dll
2007-10-31 00:55 191,536 —-a-w C:\WINDOWS\system32\drivers\symtdi.sys
2007-10-31 00:55 145,968 —-a-w C:\WINDOWS\system32\drivers\symfw.sys
2007-10-31 00:55 12,848 —-a-w C:\WINDOWS\system32\drivers\symdns.sys
2007-10-31 00:24 12,963 —-a-w C:\WINDOWS\system32\drivers\SymRedir.cat
2007-10-31 00:24 1,358 —-a-w C:\WINDOWS\system32\drivers\SymRedir.inf
2007-10-30 23:42 3,590,656 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\mshtml.dll
2007-10-30 22:13 ——— d—–w C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-10-29 22:43 1,287,680 —-a-w C:\WINDOWS\SYSTEM32\quartz.dll
2007-10-29 22:43 1,287,680 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\quartz.dll
2007-10-27 22:40 222,720 —-a-w C:\WINDOWS\SYSTEM32\wmasf.dll
2007-10-27 22:40 222,720 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wmasf.dll
2007-10-26 03:34 8,460,288 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\shell32.dll
2007-10-10 23:56 824,832 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wininet.dll
2007-10-10 23:56 232,960 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\webcheck.dll
2007-10-10 23:56 1,159,680 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\urlmon.dll
2007-10-10 23:55 671,232 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\mstime.dll
2007-10-10 23:55 63,488 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\icardie.dll
2007-10-10 23:55 6,065,664 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\ieframe.dll
2007-10-10 23:55 52,224 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\msfeedsbs.dll
2007-10-10 23:55 478,208 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\mshtmled.dll
2007-10-10 23:55 459,264 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\msfeeds.dll
2007-10-10 23:55 44,544 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\iernonce.dll
2007-10-10 23:55 384,512 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\iedkcs32.dll
2007-10-10 23:55 383,488 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\ieapfltr.dll
2007-10-10 23:55 27,648 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\jsproxy.dll
2007-10-10 23:55 267,776 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\iertutil.dll
2007-10-10 23:55 230,400 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\ieaksie.dll
2007-10-10 23:55 214,528 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\dxtrans.dll
2007-10-10 23:55 193,024 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\msrating.dll
2007-10-10 23:55 153,088 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\ieakeng.dll
2007-10-10 23:55 132,608 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\extmgr.dll
2007-10-10 23:55 124,928 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\advpack.dll
2007-10-10 23:55 105,984 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\url.dll
2007-10-10 23:55 102,400 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\occache.dll
2007-10-10 10:59 70,656 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\ie4uinit.exe
2007-10-10 10:59 625,152 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\iexplore.exe
2007-10-10 10:59 13,824 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\ieudinit.exe
2007-10-10 05:46 161,792 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\ieakui.dll
2006-04-18 21:11 87,072 -c—-w C:\Documents and Settings\Hman\Application Data\GDIPFONTCACHEV1.DAT
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{423a0a67-20c5-4b79-a4b7-2456e79acf5a}]
2007-04-11 16:19 1297432 –a—— C:\Program Files\MySpace_Customizer\tbMyS1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{B2C4B923-9C8B-4A7B-B2E5-2F0BC4F024DE}
{423A0A67-20C5-4B79-A4B7-2456E79ACF5A}
{90222687-F593-4738-B738-FBEE9C7B26DF}

[HKEY_CLASSES_ROOT\clsid\{423a0a67-20c5-4b79-a4b7-2456e79acf5a}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{423A0A67-20C5-4B79-A4B7-2456E79ACF5A}"= C:\Program Files\MySpace_Customizer\tbMyS1.dll [2007-04-11 16:19 1297432]
"{4E7BD74F-2B8D-469E-8CB0-AB60BB9AAE22}"= C:\PROGRA~1\VOL_TO~1\VOL_TO~1.DLL [2007-05-25 08:15 1904128]

[HKEY_CLASSES_ROOT\clsid\{423a0a67-20c5-4b79-a4b7-2456e79acf5a}]

[HKEY_CLASSES_ROOT\clsid\{4e7bd74f-2b8d-469e-8cb0-ab60bb9aae22}]
[HKEY_CLASSES_ROOT\vol_toolbar.VOL_TOOLBAR]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="RUNDLL32.exe" [2004-08-04 02:56 C:\WINDOWS\SYSTEM32\rundll32.exe]
"nwiz"="nwiz.exe" [2003-10-06 14:16 C:\WINDOWS\SYSTEM32\nwiz.exe]
"SiteAdvisor"="C:\Program Files\SiteAdvisor\6253\SiteAdv.exe" [2006-10-02 14:09]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-06-04 21:05]
"osCheck"="C:\Program Files\Norton Internet Security\osCheck.exe" [2007-06-26 00:00]
"Verizon_McciTrayApp"="C:\Program Files\Verizon\McciTrayApp.exe" [2007-06-06 18:52]
"QuickTime Task"="C:\PROGRAM FILES\QUICKTIME\QTTASK.exe" [2007-10-19 20:16]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-11-28 19:51]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoBandCustomize"= 0 (0x0)
"NoMovingBands"= 0 (0x0)
"NoCloseDragDropBands"= 0 (0x0)
"NoToolbarsOnTaskbar"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
C:\Program Files\Citrix\GoToAssist\480\G2AWinLogon.dll 2007-10-18 18:17 10792 C:\Program Files\Citrix\GoToAssist\480\g2awinlogon.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ :\WINDOW

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=C:\WINDOWS\pss\Digital Line Detect.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HotSync Manager.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HotSync Manager.lnk
backup=C:\WINDOWS\pss\HotSync Manager.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk
backup=C:\WINDOWS\pss\HP Image Zone Fast Start.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^MA111 Configuration Utility.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\MA111 Configuration Utility.lnk
backup=C:\WINDOWS\pss\MA111 Configuration Utility.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office Fast Start.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office Fast Start.lnk
backup=C:\WINDOWS\pss\Microsoft Office Fast Start.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office Find Fast Indexer.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office Find Fast Indexer.lnk
backup=C:\WINDOWS\pss\Microsoft Office Find Fast Indexer.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office Shortcut Bar.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office Shortcut Bar.lnk
backup=C:\WINDOWS\pss\Microsoft Office Shortcut Bar.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Verizon Online Support Center.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Verizon Online Support Center.lnk
backup=C:\WINDOWS\pss\Verizon Online Support Center.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Hman^Start Menu^Programs^Startup^Avvenu v1.0.lnk]
path=C:\Documents and Settings\Hman\Start Menu\Programs\Startup\Avvenu v1.0.lnk
backup=C:\WINDOWS\pss\Avvenu v1.0.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdaptecDirectCD]
2003-09-06 09:26 684032 –a—— C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AIM]
C:\PROGRA~1\AIM\aim.exe -cnetwait.odl

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CursorXP]
2003-03-01 16:40 125440 –a—— C:\Program Files\CursorXP\CursorXP.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDSentry]
2002-08-14 18:22 28672 -ra—— C:\WINDOWS\System32\DSentry.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2007-05-08 15:24 54840 –a—— C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2007-11-02 18:36 267048 –a—— C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]
????

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Utility]
Logi_MwX.Exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
2002-07-16 07:21 28672 –a—— C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Motive SmartBridge]
C:\PROGRA~1\VERIZO~1\SUPPOR~1\SMARTB~1\MotiveSB.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\PROGRAM FILES\QUICKTIME\QTTASK.EXE -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Run]
????

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
C:\Program Files\Common Files\Real\Update_OB\realsched.exe -osboot

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ViewMgr]
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
2006-10-18 20:05 204288 ——— C:\Program Files\Windows Media Player\WMPNSCFG.exe

S3 Otis;Audible Otis Service;C:\WINDOWS\system32\Drivers\OtisPlay.sys [2004-04-28 18:26]
S3 PortRst;PortRst;C:\WINDOWS\system32\DRIVERS\PortRst.sys [2002-01-29 16:33]
S3 tapvpn;TAP VPN Adapter;C:\WINDOWS\system32\DRIVERS\tapvpn.sys [2006-12-16 15:37]
S3 WLAN_USB;Wireless LAN USB Driver;C:\WINDOWS\system32\DRIVERS\MA111nd5.sys [2004-09-29 10:28]
S3 WlanUIB;NETGEAR 802.11b USB Driver;C:\WINDOWS\system32\DRIVERS\MA111nd5.sys [2004-09-29 10:28]
S4 GoToAssist;GoToAssist;"C:\Program Files\Citrix\GoToAssist\480\g2aservice.exe" Start=service []

*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder
"2007-12-25 17:07:12 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-12-29 14:56:51 C:\WINDOWS\Tasks\Norton Internet Security - Run Full System Scan - Hman.job"
- C:\Program Files\Norton Internet Security\Norton AntiVirus\Navw32.exeh/TASK:
.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-29 11:06:33
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-29 11:07:49
C:\ComboFix2.txt … 2007-12-29 00:47
.
2007-12-11 22:30:58 — E O F —
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:09:11 AM, on 12/29/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\SiteAdvisor\6253\SAService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Verizon\McciTrayApp.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://63.138.132.82/exchange
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dellnet.com/
R3 - URLSearchHook: MySpace Customizer Toolbar - {423a0a67-20c5-4b79-a4b7-2456e79acf5a} - C:\Program Files\MySpace_Customizer\tbMyS1.dll
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://my.yahoo.com/p/d.html?v"); (C:\Documents and Settings\HMAN\Application Data\Mozilla\Profiles\default\5sih44uv.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_02.src"); (C:\Documents and Settings\HMAN\Application Data\Mozilla\Profiles\default\5sih44uv.slt\prefs.js)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.7\NppBho.dll
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: MySpace Customizer Toolbar - {423a0a67-20c5-4b79-a4b7-2456e79acf5a} - C:\Program Files\MySpace_Customizer\tbMyS1.dll
O3 - Toolbar: (no name) - {B2C4B923-9C8B-4A7B-B2E5-2F0BC4F024DE} - (no file)
O3 - Toolbar: MySpace Customizer Toolbar - {423a0a67-20c5-4b79-a4b7-2456e79acf5a} - C:\Program Files\MySpace_Customizer\tbMyS1.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.7\UIBHO.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Verizon_McciTrayApp] C:\Program Files\Verizon\McciTrayApp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\PROGRAM FILES\QUICKTIME\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: CachePal - {5F4A4622-8370-440e-88CC-CA2256D1A08A} - C:\WINDOWS\System32\cachepal.exe
O9 - Extra 'Tools' menuitem: CachePal - {5F4A4622-8370-440e-88CC-CA2256D1A08A} - C:\WINDOWS\System32\cachepal.exe
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted IP range: http://192.168.1.1
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://activatemyfios.verizon.net/sdcCommo…IOS/tgctlcm.cab
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/u…can_unicode.cab
O16 - DPF: {13EC55CF-D993-475B-9ACA-F4A384957956} (Controller Class) - https://www.windowsonecare.com/install/cli/…nSSWebAgent.CAB
O16 - DPF: {31E68DE2-5548-4B23-88F0-C51E6A0F695E} (Microsoft PID Sniffer) - https://support.microsoft.com/OAS/ActiveX/odc.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1143671063531
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.napster.com/client/isetup.cab
O16 - DPF: {94B82441-A413-4E43-8422-D49930E69764} (TLIEFlashObj Class) - https://webchat.dell.com/Media/VisitorChat/TLIEFlash.CAB
O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {E856B973-45FD-4559-8F82-EAB539144667} (Dell PC Checkup Installer Control) - http://pccheckup.dellfix.com/rel/35/install/gtdownde.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\480\G2AWinLogon.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6253\SAService.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

–
End of file - 9453 bytes

I got a new spyware notice when scanning with Adaware sE: Win32.Trojan.Clicker. My Norton has been intercepting intermittent intrusion attempts. Otherwise it's fiuntioning pretty well and I'm online on it and not the laptop. Here are the logs:



ComboFix 07-12-21.4 - Hman 2007-12-29 18:33:29.3 - NTFSx86
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Hman\Desktop\cfscript.txt
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2007-11-28 to 2007-12-29 )))))))))))))))))))))))))))))))
.

2007-12-29 00:21 . 2007-12-29 11:40 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2007-12-29 00:21 . 2007-12-29 00:21 1,409 –a—— C:\WINDOWS\QTFont.for
2007-12-25 13:19 . 2007-12-25 13:19 d——– C:\Documents and Settings\Administrator.HAROLD\.java
2007-12-25 13:18 . 2007-12-25 13:18 d——– C:\WINDOWS\SYSTEM32\Kaspersky Lab
2007-12-25 13:18 . 2007-12-25 13:18 d——– C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-12-24 23:45 . 2007-12-24 23:45 d——– C:\Documents and Settings\Administrator.HAROLD\Application Data\Aladdin Systems
2007-12-24 10:50 . 2007-12-24 10:50 d——– C:\Documents and Settings\Administrator.HAROLD\Application Data\Lavasoft
2007-12-04 20:30 . 2004-08-04 02:07 59,264 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\USBAUDIO.sys
2007-12-04 20:29 . 2004-10-08 06:54 1,206,272 -ra—— C:\WINDOWS\SYSTEM32\DRIVERS\LVSVF2.sys
2007-12-04 20:29 . 2003-02-20 23:42 348,160 -ra—— C:\WINDOWS\SYSTEM\msvcr71.dll
2007-12-04 20:29 . 2004-10-08 06:59 326,656 -ra—— C:\WINDOWS\SYSTEM32\DRIVERS\Camdrl.sys
2007-12-04 20:29 . 2004-10-08 06:58 139,264 -ra—— C:\WINDOWS\SYSTEM\CamExL20.dll
2007-12-04 20:29 . 2004-10-08 06:59 90,112 -ra—— C:\WINDOWS\SYSTEM\CamExL20.ax
2007-12-04 20:27 . 2007-12-04 20:27 d——– C:\Program Files\Common Files\FotoWire
2007-12-04 20:27 . 2007-12-04 20:27 d——– C:\Documents and Settings\Hman\Application Data\FotoWire
2007-12-04 20:23 . 2004-10-08 12:46 53,248 -ra—— C:\WINDOWS\SYSTEM32\InstMed.exe
2007-12-04 20:17 . 2005-01-18 14:23 628,736 –a—— C:\WINDOWS\SYSTEM32\ltocx12n.ocx
2007-12-04 20:17 . 2005-01-18 17:35 462,848 –a—— C:\WINDOWS\SYSTEM32\LCamCpl.dll
2007-12-04 20:17 . 2005-01-18 17:36 282,624 –a—— C:\WINDOWS\SYSTEM32\camcpl.cpl
2007-12-04 20:17 . 2005-01-18 14:23 215,552 –a—— C:\WINDOWS\SYSTEM32\Lvkrn12n.dll
2007-12-04 20:17 . 2005-01-18 14:23 192,512 –a—— C:\WINDOWS\SYSTEM32\ltscr12n.ocx
2007-12-04 20:17 . 2003-06-09 19:39 29,795 –a—— C:\WINDOWS\SYSTEM32\ITIG726.acm
2007-11-30 23:57 . 2007-11-30 23:57 317,616 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\srtspl.sys
2007-11-30 23:57 . 2007-11-30 23:57 279,088 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\srtsp.sys
2007-11-30 23:57 . 2007-11-30 23:57 43,696 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\srtspx.sys
2007-11-30 23:57 . 2007-11-30 23:57 10,549 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\srtspx.cat
2007-11-30 23:57 . 2007-11-30 23:57 10,549 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\srtspl.cat
2007-11-30 23:57 . 2007-11-30 23:57 10,545 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\srtsp.cat
2007-11-30 23:57 . 2007-11-30 23:57 1,430 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\srtspl.inf
2007-11-30 23:57 . 2007-11-30 23:57 1,421 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\srtspx.inf
2007-11-30 23:57 . 2007-11-30 23:57 1,415 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\srtsp.inf

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-29 16:16 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2007-12-26 22:15 ——— d—–w C:\Program Files\vol_toolbar
2007-12-26 22:15 ——— d—–w C:\Program Files\Verizon
2007-12-25 15:17 ——— d—–w C:\Program Files\Trend Micro
2007-12-25 11:28 ——— d—–w C:\Documents and Settings\All Users\Application Data\Symantec
2007-12-23 16:39 ——— d—–w C:\Documents and Settings\Hman\Application Data\Skype
2007-12-23 00:00 ——— d—–w C:\Documents and Settings\All Users\Application Data\SiteAdvisor
2007-12-20 21:49 ——— d—–w C:\Program Files\SiteAdvisor
2007-12-05 23:19 805 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2007-12-05 23:19 60,800 —-a-w C:\WINDOWS\SYSTEM32\S32EVNT1.DLL
2007-12-05 23:19 123,952 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2007-12-05 23:19 10,740 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2007-12-05 23:19 ——— d—–w C:\Program Files\Symantec
2007-12-05 01:27 ——— d—–w C:\Program Files\Logitech
2007-12-05 01:21 ——— d—–w C:\Program Files\Common Files\Logitech
2007-12-05 01:16 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-11-16 21:59 ——— d—–w C:\Program Files\Norton Internet Security
2007-11-13 10:25 20,480 —-a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-11-09 23:04 ——— d—–w C:\Documents and Settings\Hman\Application Data\Lavasoft
2007-11-09 23:02 ——— d—–w C:\Program Files\Lavasoft
2007-11-09 22:47 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
2007-11-08 23:28 ——— d—–w C:\Program Files\HP
2007-11-07 21:19 ——— d—–w C:\Documents and Settings\Hman\Application Data\vol_toolbar
2007-11-06 21:38 ——— d—–w C:\Program Files\iTunes
2007-11-06 21:37 ——— d—–w C:\Program Files\iPod
2007-11-06 21:32 ——— d—–w C:\Program Files\QuickTime
2007-11-04 13:26 ——— d—–w C:\Documents and Settings\All Users\Application Data\Motive
2007-11-03 21:02 ——— d—–w C:\Documents and Settings\Hman\Application Data\Motive
2007-11-03 20:47 ——— d—–w C:\Documents and Settings\Hman\Application Data\Verizon
2007-11-03 20:47 ——— d—–w C:\Documents and Settings\All Users\Application Data\Verizon
2007-11-03 20:46 ——— d—–w C:\Program Files\Common Files\Motive
2007-11-03 20:16 ——— d—–w C:\Program Files\Comcast Web Controls
2007-10-31 00:55 625,032 —-a-w C:\WINDOWS\SYSTEM32\SymNeti.dll
2007-10-31 00:55 39,856 —-a-w C:\WINDOWS\system32\drivers\symids.sys
2007-10-31 00:55 37,936 —-a-w C:\WINDOWS\system32\drivers\symndisv.sys
2007-10-31 00:55 35,120 —-a-w C:\WINDOWS\system32\drivers\symndis.sys
2007-10-31 00:55 27,696 —-a-w C:\WINDOWS\system32\drivers\symredrv.sys
2007-10-31 00:55 242,056 —-a-w C:\WINDOWS\SYSTEM32\SymRedir.dll
2007-10-31 00:55 191,536 —-a-w C:\WINDOWS\system32\drivers\symtdi.sys
2007-10-31 00:55 145,968 —-a-w C:\WINDOWS\system32\drivers\symfw.sys
2007-10-31 00:55 12,848 —-a-w C:\WINDOWS\system32\drivers\symdns.sys
2007-10-31 00:24 12,963 —-a-w C:\WINDOWS\system32\drivers\SymRedir.cat
2007-10-31 00:24 1,358 —-a-w C:\WINDOWS\system32\drivers\SymRedir.inf
2007-10-30 23:42 3,590,656 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\mshtml.dll
2007-10-30 22:13 ——— d—–w C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-10-29 22:43 1,287,680 —-a-w C:\WINDOWS\SYSTEM32\quartz.dll
2007-10-29 22:43 1,287,680 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\quartz.dll
2007-10-27 22:40 222,720 —-a-w C:\WINDOWS\SYSTEM32\wmasf.dll
2007-10-27 22:40 222,720 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wmasf.dll
2007-10-26 03:34 8,460,288 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\shell32.dll
2007-10-10 23:56 824,832 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wininet.dll
2007-10-10 23:56 232,960 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\webcheck.dll
2007-10-10 23:56 1,159,680 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\urlmon.dll
2007-10-10 23:55 671,232 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\mstime.dll
2007-10-10 23:55 63,488 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\icardie.dll
2007-10-10 23:55 6,065,664 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\ieframe.dll
2007-10-10 23:55 52,224 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\msfeedsbs.dll
2007-10-10 23:55 478,208 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\mshtmled.dll
2007-10-10 23:55 459,264 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\msfeeds.dll
2007-10-10 23:55 44,544 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\iernonce.dll
2007-10-10 23:55 384,512 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\iedkcs32.dll
2007-10-10 23:55 383,488 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\ieapfltr.dll
2007-10-10 23:55 27,648 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\jsproxy.dll
2007-10-10 23:55 267,776 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\iertutil.dll
2007-10-10 23:55 230,400 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\ieaksie.dll
2007-10-10 23:55 214,528 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\dxtrans.dll
2007-10-10 23:55 193,024 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\msrating.dll
2007-10-10 23:55 153,088 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\ieakeng.dll
2007-10-10 23:55 132,608 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\extmgr.dll
2007-10-10 23:55 124,928 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\advpack.dll
2007-10-10 23:55 105,984 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\url.dll
2007-10-10 23:55 102,400 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\occache.dll
2007-10-10 10:59 70,656 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\ie4uinit.exe
2007-10-10 10:59 625,152 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\iexplore.exe
2007-10-10 10:59 13,824 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\ieudinit.exe
2007-10-10 05:46 161,792 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\ieakui.dll
2006-04-18 21:11 87,072 -c—-w C:\Documents and Settings\Hman\Application Data\GDIPFONTCACHEV1.DAT
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{423a0a67-20c5-4b79-a4b7-2456e79acf5a}]
2007-04-11 16:19 1297432 –a—— C:\Program Files\MySpace_Customizer\tbMyS1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{B2C4B923-9C8B-4A7B-B2E5-2F0BC4F024DE}
{423A0A67-20C5-4B79-A4B7-2456E79ACF5A}
{90222687-F593-4738-B738-FBEE9C7B26DF}

[HKEY_CLASSES_ROOT\clsid\{423a0a67-20c5-4b79-a4b7-2456e79acf5a}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{423A0A67-20C5-4B79-A4B7-2456E79ACF5A}"= C:\Program Files\MySpace_Customizer\tbMyS1.dll [2007-04-11 16:19 1297432]
"{4E7BD74F-2B8D-469E-8CB0-AB60BB9AAE22}"= C:\PROGRA~1\VOL_TO~1\VOL_TO~1.DLL [2007-05-25 08:15 1904128]

[HKEY_CLASSES_ROOT\clsid\{423a0a67-20c5-4b79-a4b7-2456e79acf5a}]

[HKEY_CLASSES_ROOT\clsid\{4e7bd74f-2b8d-469e-8cb0-ab60bb9aae22}]
[HKEY_CLASSES_ROOT\vol_toolbar.VOL_TOOLBAR]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="RUNDLL32.exe" [2004-08-04 02:56 C:\WINDOWS\SYSTEM32\rundll32.exe]
"nwiz"="nwiz.exe" [2003-10-06 14:16 C:\WINDOWS\SYSTEM32\nwiz.exe]
"SiteAdvisor"="C:\Program Files\SiteAdvisor\6253\SiteAdv.exe" [2006-10-02 14:09]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-06-04 21:05]
"osCheck"="C:\Program Files\Norton Internet Security\osCheck.exe" [2007-06-26 00:00]
"Verizon_McciTrayApp"="C:\Program Files\Verizon\McciTrayApp.exe" [2007-06-06 18:52]
"QuickTime Task"="C:\PROGRAM FILES\QUICKTIME\QTTASK.exe" [2007-10-19 20:16]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-11-28 19:51]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoBandCustomize"= 0 (0x0)
"NoMovingBands"= 0 (0x0)
"NoCloseDragDropBands"= 0 (0x0)
"NoToolbarsOnTaskbar"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
C:\Program Files\Citrix\GoToAssist\480\G2AWinLogon.dll 2007-10-18 18:17 10792 C:\Program Files\Citrix\GoToAssist\480\g2awinlogon.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ :\WINDOW

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=C:\WINDOWS\pss\Digital Line Detect.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HotSync Manager.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HotSync Manager.lnk
backup=C:\WINDOWS\pss\HotSync Manager.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk
backup=C:\WINDOWS\pss\HP Image Zone Fast Start.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^MA111 Configuration Utility.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\MA111 Configuration Utility.lnk
backup=C:\WINDOWS\pss\MA111 Configuration Utility.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office Fast Start.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office Fast Start.lnk
backup=C:\WINDOWS\pss\Microsoft Office Fast Start.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office Find Fast Indexer.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office Find Fast Indexer.lnk
backup=C:\WINDOWS\pss\Microsoft Office Find Fast Indexer.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office Shortcut Bar.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office Shortcut Bar.lnk
backup=C:\WINDOWS\pss\Microsoft Office Shortcut Bar.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Verizon Online Support Center.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Verizon Online Support Center.lnk
backup=C:\WINDOWS\pss\Verizon Online Support Center.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Hman^Start Menu^Programs^Startup^Avvenu v1.0.lnk]
path=C:\Documents and Settings\Hman\Start Menu\Programs\Startup\Avvenu v1.0.lnk
backup=C:\WINDOWS\pss\Avvenu v1.0.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdaptecDirectCD]
2003-09-06 09:26 684032 –a—— C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AIM]
C:\PROGRA~1\AIM\aim.exe -cnetwait.odl

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CursorXP]
2003-03-01 16:40 125440 –a—— C:\Program Files\CursorXP\CursorXP.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDSentry]
2002-08-14 18:22 28672 -ra—— C:\WINDOWS\System32\DSentry.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2007-05-08 15:24 54840 –a—— C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2007-11-02 18:36 267048 –a—— C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]
????

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Utility]
Logi_MwX.Exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
2002-07-16 07:21 28672 –a—— C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Motive SmartBridge]
C:\PROGRA~1\VERIZO~1\SUPPOR~1\SMARTB~1\MotiveSB.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\PROGRAM FILES\QUICKTIME\QTTASK.EXE -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Run]
????

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
C:\Program Files\Common Files\Real\Update_OB\realsched.exe -osboot

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ViewMgr]
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
2006-10-18 20:05 204288 ——— C:\Program Files\Windows Media Player\WMPNSCFG.exe

S3 Otis;Audible Otis Service;C:\WINDOWS\system32\Drivers\OtisPlay.sys [2004-04-28 18:26]
S3 PortRst;PortRst;C:\WINDOWS\system32\DRIVERS\PortRst.sys [2002-01-29 16:33]
S3 tapvpn;TAP VPN Adapter;C:\WINDOWS\system32\DRIVERS\tapvpn.sys [2006-12-16 15:37]
S3 WLAN_USB;Wireless LAN USB Driver;C:\WINDOWS\system32\DRIVERS\MA111nd5.sys [2004-09-29 10:28]
S3 WlanUIB;NETGEAR 802.11b USB Driver;C:\WINDOWS\system32\DRIVERS\MA111nd5.sys [2004-09-29 10:28]
S4 GoToAssist;GoToAssist;"C:\Program Files\Citrix\GoToAssist\480\g2aservice.exe" Start=service []

*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder
"2007-12-25 17:07:12 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-12-29 14:56:51 C:\WINDOWS\Tasks\Norton Internet Security - Run Full System Scan - Hman.job"
- C:\Program Files\Norton Internet Security\Norton AntiVirus\Navw32.exeh/TASK:
.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-29 18:42:05
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

**************************************************************************
.
Completion time: 2007-12-29 18:44:27
C:\ComboFix2.txt … 2007-12-29 11:07
C:\ComboFix3.txt … 2007-12-29 00:47
.
2007-12-11 22:30:58 — E O F —
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:48:35 PM, on 12/29/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\SiteAdvisor\6253\SAService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Verizon\McciTrayApp.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft Works\MSWorks.exe
C:\PROGRAM FILES\HP\HP SOFTWARE UPDATE\HPWUSCHD2.EXE
C:\PROGRAM FILES\ITUNES\ITUNESHELPER.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Microsoft Office\Office10\OUTLOOK.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Symantec\LiveUpdate\AUPDATE.EXE
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://63.138.132.82/exchange
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dellnet.com/
R3 - URLSearchHook: MySpace Customizer Toolbar - {423a0a67-20c5-4b79-a4b7-2456e79acf5a} - C:\Program Files\MySpace_Customizer\tbMyS1.dll
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://my.yahoo.com/p/d.html?v"); (C:\Documents and Settings\HMAN\Application Data\Mozilla\Profiles\default\5sih44uv.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_02.src"); (C:\Documents and Settings\HMAN\Application Data\Mozilla\Profiles\default\5sih44uv.slt\prefs.js)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.7\NppBho.dll
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: MySpace Customizer Toolbar - {423a0a67-20c5-4b79-a4b7-2456e79acf5a} - C:\Program Files\MySpace_Customizer\tbMyS1.dll
O3 - Toolbar: (no name) - {B2C4B923-9C8B-4A7B-B2E5-2F0BC4F024DE} - (no file)
O3 - Toolbar: MySpace Customizer Toolbar - {423a0a67-20c5-4b79-a4b7-2456e79acf5a} - C:\Program Files\MySpace_Customizer\tbMyS1.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.7\UIBHO.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Verizon_McciTrayApp] C:\Program Files\Verizon\McciTrayApp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\PROGRAM FILES\QUICKTIME\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: CachePal - {5F4A4622-8370-440e-88CC-CA2256D1A08A} - C:\WINDOWS\System32\cachepal.exe
O9 - Extra 'Tools' menuitem: CachePal - {5F4A4622-8370-440e-88CC-CA2256D1A08A} - C:\WINDOWS\System32\cachepal.exe
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted IP range: http://192.168.1.1
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://activatemyfios.verizon.net/sdcCommo…IOS/tgctlcm.cab
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/u…can_unicode.cab
O16 - DPF: {13EC55CF-D993-475B-9ACA-F4A384957956} (Controller Class) - https://www.windowsonecare.com/install/cli/…nSSWebAgent.CAB
O16 - DPF: {31E68DE2-5548-4B23-88F0-C51E6A0F695E} (Microsoft PID Sniffer) - https://support.microsoft.com/OAS/ActiveX/odc.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1143671063531
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.napster.com/client/isetup.cab
O16 - DPF: {94B82441-A413-4E43-8422-D49930E69764} (TLIEFlashObj Class) - https://webchat.dell.com/Media/VisitorChat/TLIEFlash.CAB
O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {E856B973-45FD-4559-8F82-EAB539144667} (Dell PC Checkup Installer Control) - http://pccheckup.dellfix.com/rel/35/install/gtdownde.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\480\G2AWinLogon.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6253\SAService.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

–
End of file - 10302 bytes