ComboFix 09-01-21.04 - Mike 2009-01-26 18:52:14.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.447.192 [GMT -8:00] Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe AV: Norton AntiVirus *On-access scanning enabled* (Outdated) FW: Norton AntiVirus *enabled* . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\autorun.inf C:\Documents and Settings\All Users\Application Data\nsv C:\Documents and Settings\All Users\Application Data\nsv\keys.dat C:\Documents and Settings\All Users\Application Data\nsv\s04061220 C:\Documents and Settings\All Users\Application Data\nsv\s04061220.xdc C:\Documents and Settings\All Users\Application Data\nsv\wmv0104.dbd C:\Documents and Settings\All Users\Application Data\nsv\wmv0106.ddx C:\Documents and Settings\All Users\Application Data\nsv\wmv0204.ddx C:\Documents and Settings\All Users\Application Data\nsv\wmv0315.ddx C:\Documents and Settings\All Users\Application Data\nsv\wmv0412.ddx C:\Documents and Settings\All Users\Application Data\nsv\wmv0504.ddx C:\Documents and Settings\All Users\Application Data\nsv\wmv0904.ddx C:\Documents and Settings\All Users\Application Data\nsv\wmv1125.ddx C:\Documents and Settings\All Users\Application Data\nsv\wmv1204.ddx C:\Documents and Settings\All Users\Application Data\nsv\wmv1215.dbd C:\Documents and Settings\All Users\Application Data\nsv\wmv1909.ddx C:\Documents and Settings\All Users\Application Data\nsv\wmv1920.dbd C:\Documents and Settings\All Users\Application Data\nsv\wmv2007.dbd C:\Documents and Settings\All Users\Start Menu\Programs\Startup\winlogon.lnk C:\Documents and Settings\LocalService\Application Data\NetMon C:\Documents and Settings\LocalService\Application Data\NetMon\domains.txt C:\Documents and Settings\LocalService\Application Data\NetMon\log.txt C:\Documents and Settings\Mike\Local Settings\Temporary Internet Files\QcBarA_Tmp.txt C:\Documents and Settings\Mike\Local Settings\Temporary Internet Files\QcBarK_Tmp.txt C:\Documents and Settings\Mike\Local Settings\Temporary Internet Files\QcBarL_Tmp.txt C:\Documents and Settings\Mike\Local Settings\Temporary Internet Files\QcBarP_Tmp.txt C:\Documents and Settings\Mike\Local Settings\Temporary Internet Files\QcBarT_Tmp.txt C:\Documents and Settings\Mike\Local Settings\Temporary Internet Files\search.html C:\lswmv.ini C:\Program Files\Common Files\uninstall information C:\Program Files\Microsoft Office\WINWORD.EXE C:\Program Files\network monitor C:\Program Files\screensavers.com C:\Program Files\screensavers.com\Wallpaper\swpstart.exe C:\resycled C:\resycled\ntldr.com C:\WINDOWS\brastk.exe C:\WINDOWS\IE4 Error Log.txt C:\WINDOWS\k.txt C:\WINDOWS\karna.dat C:\WINDOWS\sudbg.dat C:\WINDOWS\system32\__c0085FAE.dat C:\WINDOWS\system32\drivers\gaopdxgutupkml.sys C:\WINDOWS\system32\drivers\gaopdxmxeppjyu.sys C:\WINDOWS\system32\drivers\gaopdxxdoptumg.sys C:\WINDOWS\system32\drivers\gaopdxynalxrmh.sys C:\WINDOWS\system32\emvwm.dat C:\WINDOWS\system32\gaopdxtodeurqy.dll C:\WINDOWS\system32\instsrv.exe C:\WINDOWS\system32\izjfm.dat C:\WINDOWS\system32\karna.dat C:\WINDOWS\system32\mcacj.dat C:\WINDOWS\system32\nsvsvc C:\WINDOWS\system32\nsvsvc\License.txt C:\WINDOWS\system32\nvanb.dat C:\WINDOWS\system32\qpnsl.dat C:\WINDOWS\system32\svcp.csv C:\WINDOWS\system32\sysfile.dll C:\WINDOWS\system32\tcenn.dat C:\WINDOWS\system32\tlmny.dat C:\WINDOWS\system32\vidctrl C:\WINDOWS\system32\vidctrl\vidctrl.exe C:\WINDOWS\system32\wini101954.exe C:\WINDOWS\system32\winsub.xml C:\WINDOWS\system32\wnsapisv.exe C:\WINDOWS\system32\ypttm.dat C:\WINDOWS\ttaeh.dat C:\WINDOWS\uninstall_nmon.vbs C:\WINDOWS\winlogon.exe D:\Autorun.inf D:\resycled D:\resycled\ntldr.com . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_gaopdxserv.sys -------\Legacy_CMDSERVICE ((((((((((((((((((((((((( Files Created from 2008-12-27 to 2009-01-27 ))))))))))))))))))))))))))))))) . 2009-01-25 10:49 . 2009-01-25 10:49 d-------- C:\rsit 2009-01-24 18:50 . 2009-01-24 18:50 d-------- C:\Program Files\Trend Micro 2009-01-21 16:13 . 2009-01-21 16:13 d-------- C:\Documents and Settings\Mike\Application Data\InterVideo 2009-01-09 21:42 . 2009-01-09 21:42 12,455 --a------ C:\fo.zip 2009-01-02 21:32 . 2009-01-05 18:56 d-------- C:\Program Files\Feurio 2008-12-31 14:28 . 2008-12-31 14:28 d-------- C:\Documents and Settings\All Users\Application Data\HP Product Assistant . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-01-27 02:46 --------- d-----w C:\Documents and Settings\Mike\Application Data\DNA 2009-01-27 01:55 --------- d-----w C:\Program Files\BitTorrent 2009-01-27 01:55 --------- d-----w C:\Program Files\Azureus 2009-01-27 01:27 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater 2009-01-27 01:19 --------- d-----w C:\Program Files\DNA 2009-01-24 04:29 --------- d-----w C:\Program Files\Norton SystemWorks 2009-01-24 04:09 --------- d-----w C:\Program Files\Trader's Little Helper 2009-01-06 03:15 806 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF 2009-01-06 03:15 124,464 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS 2009-01-06 03:15 10,635 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT 2009-01-06 03:15 --------- d-----w C:\Program Files\Symantec 2009-01-06 03:14 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-12-21 15:01 --------- d-----w C:\Program Files\Google 2008-12-16 18:00 --------- d-----w C:\Program Files\NOS 2008-12-16 18:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\NOS 2008-12-16 00:07 --------- d-----w C:\Program Files\Java 2008-12-16 00:00 --------- d-----w C:\Program Files\Common Files\Adobe AIR 2008-12-15 23:58 --------- d-----w C:\Program Files\Common Files\Adobe 2008-12-15 23:26 35,124,856 ----a-w C:\AdbeRdr90_en_US.exe 2008-12-11 10:57 333,952 ----a-w C:\WINDOWS\system32\drivers\srv.sys 2008-10-26 06:30 13,164 ----a-w C:\Documents and Settings\Mike\Application Data\gurisigune.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2008-04-13 16:12 1695232] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 16:12 15360] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-03-27 12:59 68856] "BitTorrent DNA"="C:\Program Files\DNA\btdna.exe" [2008-12-18 17:23 342848] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ezShieldProtector for Px"="C:\WINDOWS\system32\ezSP_Px.exe" [2002-08-20 09:29 40960] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-01-28 17:16 98304] "SunJavaUpdateSched"="C:\Program Files\Java\jre6\bin\jusched.exe" [2008-12-15 16:08 136600] "IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\point32.exe" [2004-06-03 00:50 204800] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2006-11-21 09:38 35328] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 20:52 49152] "DMXLauncher"="C:\Program Files\Roxio\Media Experience\DMXLauncher.exe" [2006-08-14 01:07 102400] "Linksys Wireless-N Notebook Adapter"="C:\Program Files\Linksys\Wireless-N Network Monitor\WPC300N.exe" [2006-04-28 04:55 36864] "Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 16:38 583048] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-10-27 22:38 107112] "osCheck"="C:\Program Files\Norton AntiVirus\osCheck.exe" [2006-09-05 18:22 26248] "Microsoft Works Update Detection"="C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2002-07-24 21:20 28672] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 02:38 34672] "NSWosCheck"="C:\Program Files\Norton SystemWorks\osCheck.exe" [2007-12-03 01:41 25472] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoViewOnDrive"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.dvsd"= C:\PROGRA~1\COMMON~1\SONYSH~1\VideoLib\sonydv.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Real\\RealOne Player\\realplay.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\Program Files\\SmartFTP\\SmartFTP.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\Windows Media Player\\wmplayer.exe"= "C:\\Program Files\\DNA\\btdna.exe"= "C:\\Program Files\\Common Files\\Adobe\\ESD\\AdobeDownloadManager.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "8097:TCP"= 8097:TCP:EarthLink UHP Modem Support "6881:TCP"= 6881:TCP:bt "6882:TCP"= 6882:TCP:bt "6883:TCP"= 6883:TCP:bt "6884:TCP"= 6884:TCP:bt "6885:TCP"= 6885:TCP:bt "6886:TCP"= 6886:TCP:bt "6887:TCP"= 6887:TCP:bt "6888:TCP"= 6888:TCP:bt "6889:TCP"= 6889:TCP:bt "35474:TCP"= 35474:TCP:bt "34896:TCP"= 34896:TCP:bt "53209:TCP"= 53209:TCP:dl R3 EraserUtilRebootDrv;EraserUtilRebootDrv;C:\Program Files\Common Files\Symantec Shared\eengine\EraserUtilRebootDrv.sys [2008-10-26 18:32:15 99176] R4 NProtectService;Norton UnErase Protection;C:\PROGRA~1\NORTON~2\NORTON~1\NPROTECT.EXE [2005-11-03 19:08:02 95832] S1 Tcpock2;Tcpock2;\??\C:\WINDOWS\system32\drivers\kmiompen.sys --> C:\WINDOWS\system32\drivers\kmiompen.sys [?] S3 BW2NDIS5;BW2NDIS5;C:\WINDOWS\system32\Drivers\BW2NDIS5.sys --> C:\WINDOWS\system32\Drivers\BW2NDIS5.sys [?] S3 Cw75;Cw75 Device;C:\WINDOWS\system32\drivers\Cw75.sys [2005-09-19 21:49:50 24059] S3 IPN2220;Wireless-G Notebook Adapter ver.4.0 Driver;C:\WINDOWS\system32\drivers\i2220ntx.sys [2004-11-13 23:06:47 117248] S3 WrKPoET2000;WrKPoET2000;\??\C:\Program Files\WinPoET Broadband Connection\WrKPoET2000.sys --> C:\Program Files\WinPoET Broadband Connection\WrKPoET2000.sys [?] S4 gupdate1c8c5f32d29ac80;Google Update Service (gupdate1c8c5f32d29ac80);C:\Program Files\Google\Update\GoogleUpdate.exe [2008-07-15 18:24:57 133104] S4 mrtRate;mrtRate; [x] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{09dd357b-0119-11dd-968b-00183978b85f}] \Shell\AutoRun\command - G:\wd_windows_tools\setup.exe [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\886c1ded-4b7f-4f66-adb0-c6555d0feb6f] C:\WINDOWS\system32\ccqqmnr.exe [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\886c1ded-4b7f-4f66-adb0-c6555d0feb6f] C:\WINDOWS\system32\ccqqmnr.exe . Contents of the 'Scheduled Tasks' folder 2009-01-27 C:\WINDOWS\Tasks\GoogleUpdateTaskMachine.job - C:\Program Files\Google\Update\GoogleUpdate.exe [2008-08-30 08:49] 2009-01-24 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - Mike.job - C:\PROGRA~1\NORTON~1\Navw32.exe [2006-09-06 22:38] 2008-12-22 C:\WINDOWS\Tasks\Norton SystemWorks One Button Checkup.job - C:\Program Files\Norton SystemWorks\OBC.exe [2007-12-03 01:41] . - - - - ORPHANS REMOVED - - - - BHO-{23FB5ADD-DA37-4a40-9FC0-B0E2384CDE92} - (no file) BHO-{77701e16-9bfe-4b63-a5b4-7bd156758a37} - (no file) BHO-{d869742a-e5d2-4624-96c7-aae26170665e} - (no file) BHO-{EBBD88E5-C372-469D-B4C5-1FE00352AB9B} - (no file) HKCU-Run-irssyncd - C:\WINDOWS\system32\irssyncd.exe HKCU-Run-MoneyAgent - C:\Program Files\Microsoft Money\System\mnyexpr.exe . ------- Supplementary Scan ------- . uStart Page = hxxp://www.lookanddiscover.com/ uInternet Settings,ProxyOverride = uSearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q= IE: &Webshots Photo Search - C:\Program Files\Webshots\WSToolbar4IE.dll/MENUSEARCH.HTM Trusted Zone: mirarsearch.com\click Trusted Zone: mirarsearch.com\redirect DPF: DirectAnimation Java Classes - file://C:\WINDOWS\Java\classes\dajava.cab DPF: Microsoft XML Parser for Java - file://C:\WINDOWS\Java\classes\xmldso.cab DPF: {88D758A3-D33B-45FD-91E3-67749B4057FA} - hxxp://dm.screensavers.com/dm/installers/si/1/sinstaller.cab DPF: {9AC54695-69A4-46F1-BE10-10C74F9520D5} - hxxp://cabs.elitemediagroup.net/cabs/mediaview.cab DPF: {EBBD88E5-C372-469D-B4C5-1FE00352AB9B} - hxxp://fad-1107.nyc1.targetnet.com/ad/id=always&opt=htj&pt=13752112503957557007&pfin=1E4SCQ07N4JG5&cv=210&uid=1720078999&url=http://www.ouchvideo.com/mmviewer_101.cab .