ComboFix:
ComboFix 09-03-06.02 - sharrison 2009-03-09 20:14:17.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.1982.1146 [GMT -4:00]
Running from: c:\users\sharrison\Desktop\ComboFix.exe
AV: Norton Internet Security *On-access scanning enabled* (Outdated)
FW: Norton Internet Security *disabled*
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\gaopdxcounter
c:\windows\system32\tmp.reg
D:\Autorun.inf
d:\recycler\S-6-8-19-100009727-100013364-100022606-1453.com
.
((((((((((((((((((((((((( Files Created from 2009-02-10 to 2009-03-10 )))))))))))))))))))))))))))))))
.
2009-03-09 18:43 . 2009-03-09 18:43 <DIR> d-------- c:\users\sharrison\AppData\Roaming\Malwarebytes
2009-03-09 18:43 . 2009-03-09 18:43 <DIR> d-------- c:\users\All Users\Malwarebytes
2009-03-09 18:43 . 2009-03-09 18:43 <DIR> d-------- c:\programdata\Malwarebytes
2009-03-09 18:43 . 2009-03-09 18:43 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-03-09 18:43 . 2009-02-11 10:19 38,496 --a------ c:\windows\System32\drivers\mbamswissarmy.sys
2009-03-09 18:43 . 2009-02-11 10:19 15,504 --a------ c:\windows\System32\drivers\mbam.sys
2009-03-09 18:08 . 2009-03-09 18:08 691 --a------ c:\users\sharrison\AppData\Roaming\GetValue.vbs
2009-03-09 18:08 . 2009-03-09 18:08 35 --a------ c:\users\sharrison\AppData\Roaming\SetValue.bat
2009-03-06 06:25 . 2009-03-06 06:34 <DIR> d-------- c:\users\sharrison\AppData\Roaming\Mobipocket
2009-03-06 03:14 . 2009-03-06 03:14 <DIR> d-------- c:\program files\Trend Micro
2009-03-06 02:30 . 2009-01-18 17:35 15,688 --a------ c:\windows\System32\lsdelete.exe
2009-03-05 20:30 . 2009-01-18 17:30 64,160 --a------ c:\windows\System32\drivers\Lbd.sys
2009-03-05 20:29 . 2009-03-05 20:30 <DIR> d-------- c:\users\All Users\Lavasoft
2009-03-05 20:29 . 2009-03-05 20:29 <DIR> d--h-c--- c:\users\All Users\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-03-05 20:29 . 2009-03-05 20:30 <DIR> d-------- c:\programdata\Lavasoft
2009-03-05 20:29 . 2009-03-05 20:29 <DIR> d--h-c--- c:\programdata\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-03-05 20:29 . 2009-03-05 20:29 <DIR> d-------- c:\program files\Lavasoft
2009-03-04 21:46 . 2009-03-04 21:46 <DIR> d-------- c:\program files\Common Files\Scanner
2009-03-04 21:46 . 2009-03-04 21:48 <DIR> d-------- c:\program files\CA Yahoo! Anti-Spy
2009-02-28 19:39 . 2009-02-28 19:39 <DIR> d-------- c:\users\All Users\HP Product Assistant
2009-02-28 19:39 . 2009-02-28 19:39 <DIR> d-------- c:\programdata\HP Product Assistant
2009-02-28 19:38 . 2009-02-28 19:38 <DIR> d-------- c:\program files\Common Files\HP
2009-02-28 19:37 . 2008-04-08 01:31 974,848 --a------ c:\windows\System32\hpost_p01c.dll
2009-02-28 19:37 . 2008-04-08 01:31 729,088 --a------ c:\windows\System32\hposwia_p01c.dll
2009-02-28 19:37 . 2008-04-16 00:05 372,736 --a------ c:\windows\System32\hppldcoi.dll
2009-02-28 19:37 . 2008-04-16 00:05 309,760 --a------ c:\windows\System32\difxapi.dll
2009-02-28 19:37 . 2008-02-28 06:08 303,104 --a------ c:\windows\System32\hposc_p01a.dll
2009-02-28 19:34 . 2009-02-28 19:51 165,205 --a------ c:\windows\hpoins33.dat
2009-02-25 23:49 . 2009-02-25 23:49 <DIR> d-------- c:\users\All Users\WEBREG
2009-02-25 23:49 . 2009-02-25 23:49 <DIR> d-------- c:\programdata\WEBREG
2009-02-25 23:38 . 2009-02-25 22:59 165,132 --------- c:\windows\hpoins33.dat.temp
2009-02-25 23:38 . 2008-06-17 05:23 1,526 --------- c:\windows\hpomdl33.dat.temp
2009-02-25 22:36 . 2009-02-25 22:36 <DIR> d-------- c:\program files\Common Files\Hewlett-Packard
2009-02-25 22:34 . 2008-04-08 01:31 271,704 --a------ c:\windows\System32\hpzids01.dll
2009-02-25 22:33 . 2008-06-06 21:49 118,272 --a------ c:\windows\System32\hpz3l692.dll
2009-02-24 22:58 . 2009-02-24 22:58 <DIR> d-------- c:\users\Tarik\AppData\Roaming\Hewlett-Packard
2009-02-16 03:08 . 2008-12-05 00:32 428,544 --a------ c:\windows\System32\EncDec.dll
2009-02-16 03:08 . 2008-12-05 00:32 293,376 --a------ c:\windows\System32\psisdecd.dll
2009-02-16 03:08 . 2008-12-05 00:31 217,088 --a------ c:\windows\System32\psisrndr.ax
2009-02-16 03:08 . 2008-12-05 00:31 177,664 --a------ c:\windows\System32\mpg2splt.ax
2009-02-16 03:08 . 2008-12-05 00:31 80,896 --a------ c:\windows\System32\MSNP.ax
2009-02-11 00:56 . 2009-01-14 23:36 1,383,424 --a------ c:\windows\System32\mshtml.tlb
2009-02-11 00:56 . 2009-01-15 02:11 827,392 --a------ c:\windows\System32\wininet.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-09 22:08 --------- d-----w c:\program files\Google
2009-03-08 20:07 25,515 ----a-w c:\users\sharrison\AppData\Roaming\nvModes.dat
2009-03-06 10:24 --------- d-----w c:\program files\Mobipocket.com
2009-03-05 03:36 --------- d-----w c:\program files\Norton Security Scan
2009-03-01 14:15 --------- d-----w c:\programdata\WildTangent
2009-03-01 02:22 13,025 ----a-w c:\users\Tarik\AppData\Roaming\nvModes.dat
2009-02-28 23:54 --------- d-----w c:\programdata\HP
2009-02-28 02:27 --------- d-----w c:\program files\WinAce
2009-02-27 01:17 --------- d-----w c:\program files\Nick Jr. Arcade
2009-02-26 08:58 --------- d-----w c:\program files\Microsoft Silverlight
2009-02-26 03:47 --------- d-----w c:\users\sharrison\AppData\Roaming\HP
2009-02-26 02:40 --------- d-----w c:\program files\HP
2009-02-12 08:01 --------- d-----w c:\programdata\Microsoft Help
2009-02-12 08:00 --------- d-----w c:\program files\Windows Mail
2009-02-06 01:23 --------- d--h--w c:\program files\InstallShield Installation Information
2009-02-06 01:23 --------- d-----w c:\users\sharrison\AppData\Roaming\InstallShield
2009-02-06 01:23 --------- d-----w c:\program files\Dynex G USB Network Adapter
2009-02-02 18:50 --------- d-----w c:\users\sharrison\AppData\Roaming\GTek
2009-02-02 18:29 --------- d-----w c:\program files\Hewlett-Packard
2009-02-02 18:28 3,358,432 ----a-w C:\sp34510.exe
2009-01-29 01:38 --------- d-----w c:\users\sharrison\AppData\Roaming\FileZilla
2009-01-23 05:11 --------- d-----w c:\programdata\WinZip
2008-10-18 18:10 174 --sha-w c:\program files\desktop.ini
2008-02-27 18:35 56,912 ----a-w c:\users\sharrison\g2mdlhlpx.exe
2008-01-01 23:53 262,144 ----a-w c:\programdata\ntuser.dat
2007-08-31 20:43 132 ----a-w c:\users\sharrison\AppData\Roaming\wklnhst.dat
2007-07-18 05:07 534,818,290 ----a-w c:\program files\office2007.zip
2008-10-01 01:19 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2008-10-01 01:19 32,768 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2008-10-01 01:19 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
2007-09-11 02:39 16,384 --sha-w c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2007-09-11 02:39 49,152 --sha-w c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2007-09-11 02:39 16,384 --sha-w c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"GoToMeeting"="c:\program files\Citrix\GoToMeeting\198\g2mstart.exe" [2008-02-27 31816]
"Yahoo! Pager"="c:\progra~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" [2007-08-30 4670704]
"swg"="c:\program files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2008-09-01 171448]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-11-15 815104]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2007-01-09 115816]
"osCheck"="c:\program files\Norton Internet Security\osCheck.exe" [2006-10-27 22696]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2006-11-24 167936]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2006-11-06 159744]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2006-11-10 46704]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0\bin\jusched.exe" [2007-01-23 77824]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]
"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 583048]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2008-03-25 49152]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-11-07 111936]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2007-01-14 90191]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-01-14 7766016]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-01-14 81920]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-12-13 185896]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-01-10 472776]
"WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-10 317128]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-03-13 81920]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-01-18 506712]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [2006-11-07 44128]
c:\users\sharrison\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-07 101440]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Connections.lnk - c:\program files\HP Connections\6811507\Program\HP Connections.exe [2007-01-23 34520]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2008-03-25 214360]
ymetray.lnk - c:\program files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe [2008-02-05 54512]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001
"AntiVirusDisableNotify"="0x00000000"
"UpdatesDisableNotify"="0x00000000"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{74E72D7D-2CC6-4463-BC84-043B8ABC58E4}"= UDP:c:\program files\HP\QuickPlay\QP.exe:QP
"{B3CA6DB9-4620-460F-BC1D-C8DEF3EABF97}"= TCP:c:\program files\HP\QuickPlay\QP.exe:QP
"{1CDEE952-B075-487F-BB25-E119E0FE3639}"= UDP:c:\program files\HP Connections\6811507\Program\HP Connections.exe:HP Connections
"{4E578DEA-7BB7-41CA-B601-C157B744D4CE}"= c:\program files\HP Connections\6811507\Program\HP Connections:HP Connections
"{90190A85-F030-4A17-AD5B-E2CAE4E3E5AB}"= UDP:c:\program files\HP Connections\6811507\Program\HP Connections.exe:HP Connections
"{0C68EB91-5032-4072-9368-1CAC1B11D5C9}"= TCP:c:\program files\HP Connections\6811507\Program\HP Connections.exe:HP Connections
"{8C95D911-439C-4D88-9BF4-E1E2C7BE2019}"= UDP:c:\program files\HP Connections\6811507\Program\HP Connections.exe:HP Connections
"{A8FC706F-7AC3-4EAB-BF25-197AC8D52ADB}"= TCP:c:\program files\HP Connections\6811507\Program\HP Connections.exe:HP Connections
"{0719AC21-57E9-472A-AFEB-7BC44CB8882D}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{DFFD8B19-07C2-4CAE-9A87-1885FA301CC6}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{7EA05AC0-3B17-4D85-9583-AECBD14B60F1}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{0DC4F26E-BED9-45C0-9E86-94C120700B24}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{C4DD4DEE-2C11-4AF9-8CD6-95763BFEC328}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{E1DFF30D-9994-49C6-8CDC-D6A85175E766}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{550F5664-D601-4FAA-9CE5-8E14B93C8B3F}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{CF1E8135-C9A8-4657-AB48-9B1C079BEA71}"= UDP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{D4EEA5D6-DE47-4F7C-915F-C411F025EF15}"= TCP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{381A33D1-D810-4676-A4FB-DAFAEBD2AB7F}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{0C9AB74C-EE77-45A3-AE70-1F8EB4A77F51}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{A19EBC8E-3DA5-4654-8C64-40CB067249A8}"= UDP:c:\program files\Yahoo!\Yahoo! Music Jukebox\YahooMusicEngine.exe:Yahoo! Music Jukebox
"{86D255A7-2BDB-425D-B359-1DA5148F1534}"= TCP:c:\program files\Yahoo!\Yahoo! Music Jukebox\YahooMusicEngine.exe:Yahoo! Music Jukebox
"{2839B957-D636-474B-9232-C0F544F98FD4}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{1CC7F961-DB87-4BE4-99C1-8FA50462A02B}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"{D0B34029-EE77-4E45-99DD-8E7A676E7332}"= UDP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{C332D8F7-91BD-452E-A774-D830DE5D5E48}"= TCP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{24ED19FF-82BC-4FF6-BA73-31378DCCECE9}"= UDP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{238DA682-B65D-4549-A00C-E5F75904A3BD}"= TCP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{A33CDA81-B959-4900-A096-D7CA27076F12}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{091F58F5-781B-423C-9A4B-25CDBADDA8DD}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{7562A637-F4B2-4CC1-8D81-407C9A00227A}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{A389988D-8B46-4714-AB51-1A20F67DAC9E}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"{64AD5853-30FF-421D-B9D2-5EE889EA6A05}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In)
"{D2566B14-B51D-44FC-963F-65E751D188A0}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In)
"TCP Query User{76FF085E-51DE-495A-BCFF-50E79F7F404D}c:\\program files\\rhapsody\\rhapsody.exe"= UDP:c:\program files\rhapsody\rhapsody.exe:RealNetworks Rhapsody
"UDP Query User{AD65F362-6261-4AFF-A9C3-3429588BA497}c:\\program files\\rhapsody\\rhapsody.exe"= TCP:c:\program files\rhapsody\rhapsody.exe:RealNetworks Rhapsody
"TCP Query User{C7DC6E69-A313-406A-86EF-E793A28F1EE9}c:\\program files\\real\\realplayer\\realplay.exe"= UDP:c:\program files\real\realplayer\realplay.exe:RealPlayer
"UDP Query User{C8F1B9E9-22C7-4ACB-9328-8E875753521F}c:\\program files\\real\\realplayer\\realplay.exe"= TCP:c:\program files\real\realplayer\realplay.exe:RealPlayer
"{1D76A089-8CD6-4F56-99BE-8CD4D41B8F9D}"= c:\program files\HP\Digital Imaging\bin\hpqtra08.exe:hpqtra08.exe
"{CB93F517-0C1A-429A-9EAC-4BB238F62F47}"= c:\program files\HP\Digital Imaging\bin\hpqste08.exe:hpqste08.exe
"{6C9A7357-3BF9-4606-8902-F9AD3EFA410A}"= c:\program files\HP\Digital Imaging\bin\hposid01.exe:hposid01.exe
"{657889DC-1D51-46A2-A378-496269A83F84}"= c:\program files\HP\Digital Imaging\bin\hpqkygrp.exe:hpqkygrp.exe
"{0A58BF8A-A15D-4E07-9BF6-3726DC66803D}"= c:\program files\HP\Digital Imaging\bin\hpoews01.exe:hpoews01.exe
"{474BE77F-AF31-460F-8EA1-F7DEEA45592C}"= c:\program files\HP\Digital Imaging\bin\hpiscnapp.exe:hpiscnapp.exe
"{3A2D36BA-83FD-4C2E-8477-F5E36F787EAB}"= c:\program files\Common Files\HP\Digital Imaging\bin\hpqphotocrm.exe:hpqphotocrm.exe
"{4B44FEA7-3898-430E-8A0F-FA56E724E95A}"= c:\program files\HP\Digital Imaging\bin\hpqsudi.exe:hpqsudi.exe
"{437713C5-544A-44D2-8371-6C2694072C1F}"= c:\program files\HP\Digital Imaging\bin\hpqpsapp.exe:hpqpsapp.exe
"{B3E7C440-4C2E-4CEE-8FE4-73519B581D93}"= c:\program files\HP\Digital Imaging\bin\hpqpse.exe:hpqpse.exe
"{CE140A0F-ADBA-4425-857E-2E8D08C9A449}"= c:\program files\HP\Digital Imaging\bin\hpqgplgtupl.exe:hpqgplgtupl.exe
"{76921607-A9B3-4F47-9DC4-1D4F9E3EEAB8}"= c:\program files\HP\Digital Imaging\bin\hpqgpc01.exe:hpqgpc01.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\EarthLink TotalAccess\\TaskPanl.exe"= c:\program files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink
"c:\\Program Files\\Yahoo!\\Yahoo! Music Jukebox\\YahooMusicEngine.exe"= c:\program files\Yahoo!\Yahoo! Music Jukebox\YahooMusicEngine.exe:*:Enabled:Yahoo! Music Jukebox
R0 Lbd;Lbd;c:\windows\System32\drivers\Lbd.sys [2009-03-05 64160]
R1 IDSvix86;Symantec Intrusion Prevention Driver;c:\progra~2\Symantec\DEFINI~1\SymcData\idsdefs\20070921.001\IDSvix86.sys [2007-09-22 180272]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-01-18 921936]
R3 dhdusb.NTx86;Dynex Wireless G USB Network Adapter Service;c:\windows\System32\drivers\bcmusbdhdlh.sys [2009-02-05 238072]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2007-09-22 112688]
R3 SYMNDISV;SYMNDISV;c:\windows\System32\drivers\symndisv.sys [2008-10-03 37936]
--- Other Services/Drivers In Memory ---
*NewlyCreated* - COMHOST
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H]
\shell\AutoRun\command - H:\LaunchU3.exe -a
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{97a88d4c-85f5-11dd-a021-0016d31cfb2c}]
\shell\AutoRun\command - G:\LaunchU3.exe -a
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a8114900-6890-11dc-b29f-de3a4f50fd08}]
\shell\AutoRun\command - F:\setupSNK.exe
.
Contents of the 'Scheduled Tasks' folder
2009-03-09 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 17:34]
2009-03-07 c:\windows\Tasks\Norton Internet Security - Run Full System Scan - sharrison.job
- c:\progra~1\NORTON~1\NORTON~1\Navw32.exe [2006-11-08 03:48]
2009-03-01 c:\windows\Tasks\Norton Security Scan for sharrison.job
- c:\program files\Norton Security Scan\Nss.exe [2008-09-19 05:18]
.
- - - - ORPHANS REMOVED - - - -
HKCU-RunOnce-Shockwave Updater - c:\windows\System32\Adobe\SHOCKW~1\SWHELP~1.EXE -Update -1100429 -Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; SIMBAR={7A729030-F5CF-4734-84EB-7DAC33B7D146}; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; InfoPath.2; Zango 10.3.75.0; .NET CLR 3.5.30729; .NET
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = *.local
IE: Copy to Semagic - c:\program files\Semagic\copy.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Semagic - c:\program files\Semagic\link.htm
Trusted Zone: real.com\rhap-app-4-0
Trusted Zone: real.com\rhapreg
FF - ProfilePath - c:\users\sharrison\AppData\Roaming\Mozilla\Firefox\Profiles\wj1lnwqc.default\
FF - prefs.js: browser.search.defaulturl -
hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-nick&p=FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage -
hxxp://www.yahoo.com/?.home=ytffFF - prefs.js: keyword.URL -
hxxp://search.sweetim.com/search.asp?src=2&q= 1 file(s) moved.
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava11.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava12.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava13.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava14.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava32.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjpi160.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npoji610.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2009-03-09 20:18:19
Windows 6.0.6001 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2009-03-09 20:20:34
ComboFix-quarantined-files.txt 2009-03-10 00:20:30
Pre-Run: 67,486,531,584 bytes free
Post-Run: 69,639,983,104 bytes free
282 --- E O F --- 2009-02-27 08:00:16
HiJackThis:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:59:40, on 3/9/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Java\jre1.6.0\bin\jusched.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\WindowsMobile\wmdc.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Citrix\GoToMeeting\198\g2mstart.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\HP Connections\6811507\Program\HP Connections.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Windows\System32\mobsync.exe
C:\Windows\ehome\ehmsas.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Citrix\GoToMeeting\198\g2mcomm.exe
C:\Program Files\Citrix\GoToMeeting\198\g2mlauncher.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - BHO: KTBho Class - {25EDC164-41A6-47C3-80BD-5E4FBE1BA7AB} - C:\PROGRA~1\kaboodle\KABOOD~1\KTBar.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll (file missing)
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: Kaboodle Toolbar - {92857633-2441-4A14-8236-DFCB97AD3E87} - C:\PROGRA~1\kaboodle\KABOOD~1\KTBar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (file missing)
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "c:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0\bin\jusched.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [GoToMeeting] C:\Program Files\Citrix\GoToMeeting\198\g2mstart.exe "/Trigger RunAtLogon"
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: HP Connections.lnk = C:\Program Files\HP Connections\6811507\Program\HP Connections.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: ymetray.lnk = C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe
O8 - Extra context menu item: Copy to Semagic - C:\Program Files\Semagic\copy.htm
O8 - Extra context menu item: E&xport to Microsoft Excel -
res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Semagic - C:\Program Files\Semagic\link.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: HP Smart Select - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O13 - Gopher Prefix:
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Roxio\Roxio MyDVD Basic v9\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
--
End of file - 12781 bytes