DDS (Ver_09-02-01.01) - NTFSx86 Run by [removed] at 10:01:24.53 on Mon 02/03/2009 Internet Explorer: 7.0.5730.13 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3061.2404 [GMT 11:00] AV: Norton 360 *On-access scanning enabled* (Updated) FW: Norton 360 *enabled* ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup svchost.exe svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\sttray.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Adobe\Distillr\Acrotray.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\WINDOWS\system32\fireface.exe C:\WINDOWS\system32\firefacemix.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe C:\Program Files\Logitech\QuickCam\Quickcam.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Documents and Settings\Michael Setter\Local Settings\Application Data\Google\Update\GoogleUpdate.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe C:\Program Files\iDumpPro\NMSAccessU.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\CyberLink\Shared Files\RichVideo.exe C:\Program Files\SigmaTel\C-Major Audio\WDM\STacSV.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\Documents and Settings\Michael Setter\Desktop\dds.scr ============== Pseudo HJT Report =============== uDefault_Search_URL = hxxp://www.google.com/ie uStart Page = hxxp://www.google.com.au/ uInternet Settings,ProxyOverride = *.local uSearchURL,(Default) = hxxp://www.google.com/search?q=%s BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\activex\AcroIEHelper.dll BHO: NCO 2.0 IE BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - c:\program files\common files\symantec shared\coshared\browser\2.6\coIEPlg.dll BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\progra~1\common~1\symant~1\ids\IPSBHO.dll BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dll BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\adobe\acrobat\AcroIEFavClient.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.0.926.3450\swg.dll BHO: Windows Live Toolbar Helper: {bdbd1dad-c946-4a17-adc1-64b5b4ff55d0} - c:\program files\windows live toolbar\msntb.dll BHO: NoExplorer - No File BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_219B3E1547538286.dll BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat\AcroIEFavClient.dll TB: Windows Live Toolbar: {bdad1dad-c946-4a17-adc1-64b5b4ff55d0} - c:\program files\windows live toolbar\msntb.dll TB: &Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll TB: Show Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - c:\program files\common files\symantec shared\coshared\browser\2.6\CoIEPlg.dll TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File EB: Adobe PDF: {182ec0be-5110-49c8-a062-beb1d02a220b} - c:\program files\adobe\acrobat\AcroIEFavClient.dll EB: Groove Folder Synchronization: {2a541ae1-5bf6-4665-a8a3-cfa9672e4291} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe uRun: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "c:\program files\common files\ahead\lib\NMBgMonitor.exe" uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe uRun: [Google Update] "c:\documents and settings\michael setter\local settings\application data\google\update\GoogleUpdate.exe" /c mRun: [SigmatelSysTrayApp] sttray.exe mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [nwiz] nwiz.exe /install mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe" mRun: [Acrobat Assistant 7.0] "c:\program files\adobe\distillr\Acrotray.exe" mRun: [NeroFilterCheck] c:\program files\common files\ahead\lib\NeroCheck.exe mRun: [RemoteControl] "c:\program files\cyberlink\powerdvd\PDVDServ.exe" mRun: [LanguageShortcut] "c:\program files\cyberlink\powerdvd\language\Language.exe" mRun: [FirefaceTray] fireface.exe mRun: [FirefaceMixTray] firefacemix.exe mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" mRun: [LogitechCommunicationsManager] "c:\program files\common files\logishrd\lcommgr\Communications_Helper.exe" mRun: [LogitechQuickCamRibbon] "c:\program files\logitech\quickcam\Quickcam.exe" /hide mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\bin\AppleSyncNotifier.exe mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" mRun: [UnlockerAssistant] "c:\program files\unlocker\UnlockerAssistant.exe" mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe" mRun: [osCheck] "c:\program files\norton 360\osCheck.exe" mRun: [H2O] c:\program files\syncrosoft\pos\h2o\cledx.exe dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE StartupFolder: c:\docume~1\michae~1\startm~1\programs\startup\onenot~1.lnk - c:\program files\microsoft office\office12\ONENOTEM.EXE StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobea~1.lnk - c:\windows\installer\{ac76ba86-1033-0000-7760-100000000002}\SC_Acrobat.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe uPolicies-explorer: NoThemesTab = 0 (0x0) uPolicies-explorer: ForceActiveDesktopOn = 0 (0x0) uPolicies-system: NoDispAppearancePage = 0 (0x0) uPolicies-system: NoColorChoice = 0 (0x0) uPolicies-system: NoSizeChoice = 0 (0x0) uPolicies-system: NoVisualStyleChoice = 0 (0x0) uPolicies-system: NoDispSettingsPage = 0 (0x0) IE: &Windows Live Search - c:\program files\windows live toolbar\msntb.dll/search.htm IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx IE: Convert link target to Adobe PDF - c:\program files\adobe\acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert link target to existing PDF - c:\program files\adobe\acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert selected links to Adobe PDF - c:\program files\adobe\acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html IE: Convert selected links to existing PDF - c:\program files\adobe\acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html IE: Convert selection to Adobe PDF - c:\program files\adobe\acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert selection to existing PDF - c:\program files\adobe\acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert to Adobe PDF - c:\program files\adobe\acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert to existing PDF - c:\program files\adobe\acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000 IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll ============= SERVICES / DRIVERS =============== R1 Asapi;Asapi;c:\windows\system32\drivers\asapi.sys [2008-6-12 11264] R2 {95808DC4-FA4A-4c74-92FE-5B863F82066B};{95808DC4-FA4A-4c74-92FE-5B863F82066B};c:\program files\cyberlink\powerdvd\000.fcl [2008-6-10 13560] R2 aawservice;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\aawservice.exe [2008-5-12 611664] R2 ccEvtMgr;Symantec Event Manager;c:\program files\common files\symantec shared\CCSVCHST.EXE [2008-2-19 149352] R2 ccSetMgr;Symantec Settings Manager;c:\program files\common files\symantec shared\CCSVCHST.EXE [2008-2-19 149352] R2 LiveUpdate Notice;LiveUpdate Notice;c:\program files\common files\symantec shared\CCSVCHST.EXE [2008-2-19 149352] R3 CLEDX;Team H2O CLEDX service;c:\windows\system32\drivers\cledx.sys [2008-6-12 33792] R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2009-2-26 101936] R3 fireface;Service for Fireface (WDM);c:\windows\system32\drivers\fireface.sys [2008-6-12 79232] R3 NAVENG;NAVENG;c:\progra~1\common~1\symant~1\virusd~1\20090301.005\NAVENG.SYS [2009-3-2 89104] R3 NAVEX15;NAVEX15;c:\progra~1\common~1\symant~1\virusd~1\20090301.005\NAVEX15.SYS [2009-3-2 876144] R3 Symantec Core LC;Symantec Core LC;c:\progra~1\common~1\symant~1\ccpd-lc\symlcsvc.exe [2009-2-18 1245064] S3 COH_Mon;COH_Mon;c:\windows\system32\drivers\COH_Mon.sys [2008-1-13 23888] =============== Created Last 30 ================ 2009-02-28 14:06 147,425 a------- c:\windows\system32\SYNSOACC-Aide.chm 2009-02-28 14:06 120,468 a------- c:\windows\system32\SYNSOACC-Hilfe.chm 2009-02-28 14:06 114,279 a------- c:\windows\system32\SYNSOACC-Help.chm 2009-02-28 14:06 45,056 a------- c:\windows\system32\Synsopos.exe 2009-02-28 14:06 704,512 a------- c:\windows\system32\SYNSOACC.dll 2009-02-28 14:06 147,456 a------- c:\windows\system32\SynsoLChk.dll 2009-02-28 14:06 --d----- c:\program files\Syncrosoft 2009-02-19 12:03 579,464 a------- c:\windows\system32\SymNeti.dll 2009-02-19 12:03 207,240 a------- c:\windows\system32\SymRedir.dll 2009-02-19 11:31 9,844 a------- c:\windows\system32\drivers\SymRedir.cat 2009-02-19 11:31 1,611 a------- c:\windows\system32\drivers\SymRedir.inf 2009-02-19 11:31 41,008 a------- c:\windows\system32\drivers\symndisv.sys 2009-02-19 11:31 184,496 a------- c:\windows\system32\drivers\symtdi.sys 2009-02-19 11:31 96,560 a------- c:\windows\system32\drivers\symfw.sys 2009-02-19 11:31 38,576 a------- c:\windows\system32\drivers\symids.sys 2009-02-19 11:31 37,424 a------- c:\windows\system32\drivers\symndis.sys 2009-02-19 11:31 22,320 a------- c:\windows\system32\drivers\symredrv.sys 2009-02-19 11:31 13,616 a------- c:\windows\system32\drivers\symdns.sys 2009-02-18 07:54 --d----- c:\program files\Norton 360 2009-02-18 07:53 124,464 a------- c:\windows\system32\drivers\SYMEVENT.SYS 2009-02-18 07:53 60,808 a------- c:\windows\system32\S32EVNT1.DLL 2009-02-18 07:53 10,635 a------- c:\windows\system32\drivers\SYMEVENT.CAT 2009-02-18 07:53 806 a------- c:\windows\system32\drivers\SYMEVENT.INF 2009-02-18 00:06 --d----- c:\docume~1\michae~1\applic~1\Desktopicon 2009-02-18 00:06 --d----- c:\windows\E80F62FF5D3C4A1984099721F2928206.TMP 2009-02-18 00:06 --d----- c:\program files\CCleaner 2009-02-17 07:36 --d----- c:\program files\ArtsAcoustic Reverb 2009-02-17 07:36 --d----- c:\docume~1\alluse~1\applic~1\ArtsAcoustic 2009-02-16 19:35 221,184 a------- c:\windows\system32\wmpns.dll 2009-02-15 13:18 --d----- c:\program files\Trend Micro 2009-02-14 08:57 --d----- C:\PerfLogs 2009-02-09 17:39 44,544 a------- c:\windows\system32\msxml4a.dll 2009-02-09 17:39 309,616 a------- c:\windows\system32\wmv8dmod.dll 2009-02-09 17:39 245,760 a------- c:\windows\system32\mp4sds32.ax 2009-02-09 17:39 420,240 a------- c:\windows\system32\mpg4c32.dll 2009-02-09 17:37 491,520 a------- c:\windows\system32\mgxoschk.dll 2009-02-09 17:37 2,770 a------- c:\windows\mgxoschk.ini 2009-02-09 13:21 --d----- c:\windows\system32\N360_BACKUP 2009-02-09 11:41 --d----- c:\program files\Symantec 2009-02-09 11:41 --d----- c:\docume~1\alluse~1\applic~1\Symantec 2009-02-09 11:31 --d----- c:\docume~1\michae~1\applic~1\Symantec 2009-02-09 09:47 a-dshr-- C:\cmdcons 2009-02-09 09:46 --d----- C:\ComboFix 2009-02-09 09:43 161,792 a------- c:\windows\SWREG.exe 2009-02-09 09:43 98,816 a------- c:\windows\sed.exe 2009-02-08 14:23 --d----- c:\program files\YAMAHA 2009-02-07 21:45 --d----- c:\program files\Propellerhead 2009-02-06 14:34 1,233,979 a------- C:\Delirium mix new gatirs.cpr 2009-02-04 22:34 1,345,755 a------- C:\Delirium mix.cpr 2009-02-04 17:46 1,183,808 a------- C:\Deliriumin bfd seq.cpr 2009-02-03 14:25 1,229,158 a------- C:\Delirium.cpr ==================== Find3M ==================== 2009-02-19 11:31 31,280 a------- c:\windows\system32\drivers\SymIM.sys 2009-02-11 10:19 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys 2009-02-11 10:19 15,504 a------- c:\windows\system32\drivers\mbam.sys 2009-01-30 08:56 410,984 a------- c:\windows\system32\deploytk.dll 2008-12-21 10:15 826,368 a------- c:\windows\system32\wininet.dll ============= FINISH: 10:01:36.59 ===============