ComboFix 10-03-15.04 - Francine Fua 03/15/2010 22:14:09.3.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1583 [GMT -7:00]
Running from: c:\documents and settings\Francine Fua\Desktop\ComboFix.exe
AV: Norton Security Suite *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Security Suite *disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
.
((((((((((((((((((((((((( Files Created from 2010-02-16 to 2010-03-16 )))))))))))))))))))))))))))))))
.
2010-03-16 05:12 . 2010-02-13 01:41 558448 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\components\coFFPlgn.dll
2010-03-16 05:12 . 2010-02-02 03:20 165240 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\IPSFFPlgn\components\IPSFFPl.dll
2010-03-16 02:32 . 2010-03-16 02:32 -------- d-----w- c:\windows\CKS08GOW4CKS08GO
2010-03-14 21:10 . 2010-02-27 20:10 84912 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100314.003\NAVENG.SYS
2010-03-14 21:10 . 2010-02-27 20:10 177520 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100314.003\NAVENG32.DLL
2010-03-14 21:10 . 2010-02-27 20:10 1647984 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100314.003\NAVEX32A.DLL
2010-03-14 21:10 . 2010-02-27 20:10 1324720 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100314.003\NAVEX15.SYS
2010-03-14 21:10 . 2010-02-27 20:10 102448 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100314.003\ERASER.SYS
2010-03-14 21:10 . 2010-02-27 20:10 371248 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100314.003\EECTRL.SYS
2010-03-14 21:10 . 2010-02-27 20:10 2747440 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100314.003\CCERASER.DLL
2010-03-14 21:10 . 2010-02-27 20:10 259440 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100314.003\ECMSVR32.DLL
2010-03-12 22:57 . 2010-03-12 22:57 -------- d-----w- c:\program files\ESET
2010-03-12 20:01 . 2010-03-12 20:01 -------- d-----w- C:\_OTL
2010-03-11 23:07 . 2010-03-11 23:07 -------- d-----w- c:\documents and settings\HelpAssistant\WINDOWS
2010-03-11 23:07 . 2010-03-11 23:07 -------- d-----w- c:\documents and settings\HelpAssistant\UserData
2010-03-11 23:07 . 2007-01-19 01:20 968448 ----a-w- c:\documents and settings\HelpAssistant\USBKeyPrepF6.exe
2010-03-11 23:07 . 2010-03-11 23:07 -------- d-----w- c:\documents and settings\HelpAssistant\Shared
2010-03-11 23:07 . 2010-03-11 23:07 -------- d-----w- c:\documents and settings\HelpAssistant\PrivacIE
2010-03-11 03:10 . 2009-10-28 22:37 811896 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100310.001\Scxpx86.dll
2010-03-11 03:10 . 2009-10-28 22:37 329592 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100310.001\IDSXpx86.sys
2010-03-11 03:10 . 2009-10-28 22:37 488312 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100310.001\IDSxpx86.dll
2010-03-11 03:10 . 2009-10-28 22:37 343088 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100310.001\IDSvix86.sys
2010-03-11 03:10 . 2009-10-28 22:37 466992 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100310.001\IDSviA64.sys
2010-03-11 02:43 . 2010-03-11 02:43 -------- d-----w- c:\documents and settings\All Users\Symantec Temporary Files
2010-03-09 23:24 . 2010-03-09 23:24 -------- d-----w- c:\program files\Norton Support
2010-03-09 23:24 . 2010-03-09 23:24 -------- d-----w- c:\documents and settings\Francine Fua\Local Settings\Application Data\Symantec
2010-02-28 05:00 . 2009-10-28 22:37 343088 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100224.002\IDSvix86.sys
2010-02-28 05:00 . 2009-10-28 22:37 329592 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100224.002\IDSXpx86.sys
2010-02-28 05:00 . 2009-10-28 22:37 811896 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100224.002\Scxpx86.dll
2010-02-28 05:00 . 2009-10-28 22:37 488312 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100224.002\IDSxpx86.dll
2010-02-28 05:00 . 2009-10-28 22:37 466992 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100224.002\IDSviA64.sys
2010-02-28 04:37 . 2010-02-28 04:37 -------- d-----w- c:\documents and settings\Francine Fua\Application Data\Malwarebytes
2010-02-28 02:58 . 2010-02-28 02:58 1291104 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\SyKnAppS\SyKnAppS.dll
2010-02-28 02:58 . 2010-02-28 02:58 136840 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\SyKnAppS\patch25.dll
2010-02-28 02:58 . 2010-02-28 02:58 776952 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\CLT\cltLMSx.dll
2010-02-28 02:57 . 2010-02-28 20:34 -------- d-----w- c:\windows\system32\drivers\N360
2010-02-28 02:57 . 2010-02-28 02:57 -------- d-----w- c:\program files\Norton Security Suite
2010-02-28 02:57 . 2010-02-28 02:57 -------- d-----w- c:\program files\Windows Sidebar
2010-02-28 02:57 . 2010-02-28 02:57 -------- d-----w- c:\program files\NortonInstaller
2010-02-28 02:31 . 2006-12-07 18:45 110592 ----a-w- c:\documents and settings\Administrator\Application Data\U3\temp\cleanup.exe
2010-02-28 02:31 . 2010-02-28 02:31 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Symantec
2010-02-28 02:16 . 2010-02-28 02:16 36400 ----a-r- c:\windows\system32\drivers\SymIM.sys
2010-02-28 02:16 . 2010-02-28 02:58 60808 ----a-w- c:\windows\system32\S32EVNT1.DLL
2010-02-28 02:16 . 2010-02-28 02:58 124976 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2010-02-28 02:15 . 2010-03-11 02:42 -------- d-----w- c:\documents and settings\All Users\Application Data\Norton
2010-02-28 02:15 . 2010-02-28 02:15 -------- d-----w- c:\documents and settings\All Users\Application Data\NortonInstaller
2010-02-28 01:40 . 2010-02-28 03:25 5115824 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-02-28 01:40 . 2010-02-28 01:40 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2010-02-28 01:40 . 2010-01-08 00:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-28 01:40 . 2010-02-28 03:25 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-02-28 01:40 . 2010-02-28 01:40 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-02-28 01:40 . 2010-01-08 00:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-02-28 01:39 . 2006-12-07 18:45 3096576 ---ha-w- c:\documents and settings\Administrator\Application Data\U3\temp\Launchpad Removal.exe
2010-02-28 01:39 . 2010-02-28 01:39 -------- d-----w- c:\documents and settings\Administrator\Application Data\U3
2010-02-25 20:40 . 2010-02-25 20:40 -------- d-----w- c:\documents and settings\HelpAssistant\Incomplete
2010-02-25 04:02 . 2010-03-16 05:09 -------- d-----w- c:\documents and settings\HelpAssistant
2010-02-25 04:02 . 2010-02-25 05:32 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software
2010-02-25 03:46 . 2010-02-25 03:46 -------- d-----w- c:\documents and settings\Francine Fua\Application Data\AVG8
2010-02-25 03:10 . 2010-02-28 01:06 -------- d-----w- c:\documents and settings\Francine Fua\Local Settings\Application Data\ocapqa
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-11 03:12 . 2006-06-22 19:40 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec
2010-02-28 05:18 . 2008-08-04 23:56 -------- d-----w- c:\program files\Alwil Software
2010-02-28 05:00 . 2006-06-22 19:40 -------- d-----w- c:\program files\Common Files\Symantec Shared
2010-02-28 05:00 . 2010-02-25 05:12 -------- d-----w- c:\program files\PCPitstop
2010-02-28 02:58 . 2010-02-28 02:16 806 ----a-w- c:\windows\system32\drivers\SYMEVENT.INF
2010-02-28 02:58 . 2010-02-28 02:16 7456 ----a-w- c:\windows\system32\drivers\SYMEVENT.CAT
2010-02-28 02:58 . 2006-06-22 19:40 -------- d-----w- c:\program files\Symantec
2010-02-28 02:58 . 2008-01-29 19:01 26600 ----a-r- c:\windows\system32\drivers\GEARAspiWDM.sys
2010-02-28 02:58 . 2008-01-29 19:02 107368 ----a-r- c:\windows\system32\GEARAspi.dll
2010-02-28 00:59 . 2007-10-13 17:31 -------- d-----w- c:\program files\Dl_cats
2010-02-28 00:54 . 2006-07-19 22:09 76376 -c--a-w- c:\documents and settings\Francine Fua\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-02-25 06:25 . 2010-02-25 05:12 -------- d-----w- c:\documents and settings\All Users\Application Data\PCPitstop
2010-02-25 05:22 . 2010-02-25 05:22 -------- d-----w- c:\documents and settings\Administrator\Application Data\AVG8
2010-02-11 04:06 . 2007-11-01 02:16 -------- d-----w- c:\documents and settings\Francine Fua\Application Data\Move Networks
2010-02-04 06:29 . 2009-11-03 19:42 143976 ----a-w- c:\documents and settings\Francine Fua\Application Data\Move Networks\uninstall.exe
2010-02-04 06:29 . 2009-10-15 00:50 5642688 ----a-w- c:\documents and settings\Francine Fua\Application Data\Move Networks\plugins\npqmp071701000002.dll
2010-02-04 06:29 . 2010-02-04 06:28 1794456 ----a-w- c:\documents and settings\Francine Fua\Application Data\Move Networks\MoveMediaPlayerWin_071701000002.exe
2010-02-02 06:33 . 2009-12-10 19:26 4187512 ----a-w- c:\documents and settings\Francine Fua\Application Data\Move Networks\plugins\npqmp071505000011.dll
2010-02-02 06:33 . 2010-02-02 06:28 1438976 ----a-w- c:\documents and settings\Francine Fua\Application Data\Move Networks\MoveMediaPlayerWin_071505000011.exe
2009-12-31 16:50 . 2005-08-16 09:18 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-21 19:14 . 2005-08-16 09:18 916480 ------w- c:\windows\system32\wininet.dll
2009-12-17 08:09 . 2010-02-05 23:25 49241 ------w- c:\documents and settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4482.14.4\sb_BunkerHill.dll
2009-12-16 18:43 . 2005-08-16 09:37 343040 ----a-w- c:\windows\system32\mspaint.exe
2009-12-16 15:07 . 2010-02-05 23:25 136528 ------w- c:\documents and settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4482.14.4\Vercopy.exe
2009-12-16 15:07 . 2010-02-05 23:25 136528 ------w- c:\documents and settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4482.14.4\AOLSetup.exe
2009-01-27 01:34 . 2009-01-27 01:34 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-01-27 01:34 . 2009-01-27 01:34 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Aim6"="c:\program files\AIM6\aim6.exe" [2009-05-19 49968]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-02-20 4363504]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-29 67584]
"CTSysVol"="c:\program files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-10-31 57344]
"MBMon"="CTMBHA.DLL" [2006-03-03 1355938]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-12-06 127035]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-08 761947]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-03 45056]
"SigmatelSysTrayApp"="c:\program files\SigmaTel\C-Major Audio\WDM\stsystra.exe" [2007-05-10 405504]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-27 413696]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-05-14 177472]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128]
"snp325"="c:\windows\vsnp325.exe" [2007-05-10 835584]
"DLCGCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\DLCGtime.dll" [2006-10-20 73728]
"PC Pitstop Diskmd3 Reminder"="c:\program files\PCPitstop\DiskMD3\Reminder-Diskmd3.exe" [2009-01-27 198656]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng1.exe [2005-6-16 49152]
Clean Access Agent.lnk - c:\program files\Cisco Systems\Clean Access Agent\CCAAgent.exe [2007-9-7 2056275]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2008-1-2 24576]
NkbMonitor.exe.lnk - c:\program files\Nikon\PictureProject\NkbMonitor.exe [2008-1-3 118784]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]
@="FSFilter Activity Monitor"
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Dell Network Assistant.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Dell Network Assistant.lnk
backup=c:\windows\pss\Dell Network Assistant.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
2005-06-07 06:46 57344 -c--a-w- c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-01-12 06:16 39792 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AIM]
c:\program files\AIM\aim.exe [BU]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
2009-05-19 05:23 49968 ----a-w- c:\program files\AIM6\aim6.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC]
2006-01-03 01:41 45056 ----a-w- c:\program files\ATI Technologies\ATI.ACE\CLI.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative Detector]
2004-12-02 23:23 102400 ------w- c:\program files\Creative\MediaSource\Detector\CTDetect.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell QuickSet]
2007-05-14 22:23 1191936 ----a-w- c:\program files\Dell\QuickSet\quickset.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dlcgmon.exe]
2006-12-08 04:33 430984 -c--a-w- c:\program files\Dell AIO 810\DLCGmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]
2005-12-10 01:29 49152 -c----w- c:\program files\CyberLink\PowerDVD\DVDLauncher.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FaxCenterServer]
2006-12-08 04:35 312200 -c--a-w- c:\program files\Dell Fax Solutions\fm3032.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [BU]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelWireless]
2006-10-19 00:58 696320 -c--a-w- c:\program files\Intel\Wireless\Bin\iFrmewrk.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelZeroConfig]
2006-10-19 01:04 802816 -c--a-w- c:\program files\Intel\Wireless\Bin\ZCfgSvc.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
2005-06-10 15:44 249856 -c--a-w- c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
2005-06-10 15:44 81920 -c--a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2009-07-13 21:03 292128 ----a-w- c:\program files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ModemOnHold]
2003-09-10 07:24 20480 ------w- c:\program files\NetWaiting\netwaiting.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MskAgentexe]
c:\program files\McAfee\MSK\MskAgent.exe [BU]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12 1695232 ----a-w- c:\program files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-05-27 00:18 413696 ----a-w- c:\program files\QuickTime\QTTask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SetDefaultMIDI]
2004-12-22 09:40 24576 ----a-w- c:\windows\MIDIDEF.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SiteAdvisor]
c:\program files\SiteAdvisor\6253\SiteAdv.exe [BU]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2007-09-25 09:11 132496 -c--a-w- c:\program files\Java\jre1.6.0_03\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [BU]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
2006-03-08 16:48 761947 ----a-w- c:\program files\Synaptics\SynTP\SynTPEnh.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VoiceCenter]
2006-01-02 14:13 1126400 -c----w- c:\program files\Creative\VoiceCenter\AndreaVC.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3 (0x3)
"IDriverT"=3 (0x3)
"HidServ"=2 (0x2)
"Fax"=2 (0x2)
"Apple Mobile Device"=2 (0x2)
"matlabserver"=2 (0x2)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\America Online 9.0\\waol.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"65533:TCP"= 65533:TCP:Services
"52344:TCP"= 52344:TCP:Services
"3246:TCP"= 3246:TCP:Services
"2479:TCP"= 2479:TCP:Services
"3389:TCP"= 3389:TCP:Remote Desktop
"8114:TCP"= 8114:TCP:Services
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360\0308000.029\SymEFA.sys [2/28/2010 1:25 PM 310320]
R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\N360\0308000.029\BHDrvx86.sys [2/28/2010 1:25 PM 259632]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\N360\0308000.029\cchpx86.sys [2/28/2010 1:25 PM 482432]
R2 dlcd_device;dlcd_device;c:\windows\system32\dlcdcoms.exe -service --> c:\windows\system32\dlcdcoms.exe -service [?]
R2 N360;Norton Security Suite;c:\program files\Norton Security Suite\Engine\3.8.0.41\ccSvcHst.exe [2/28/2010 1:25 PM 117640]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [3/3/2008 11:42 PM 24652]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2/27/2010 1:10 PM 102448]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [11/10/2006 4:16 PM 611064]
S1 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100310.001\IDSXpx86.sys [3/10/2010 8:10 PM 329592]
S3 EraserUtilDrvI9;EraserUtilDrvI9;\??\c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrvI9.sys --> c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrvI9.sys [?]
S3 SNP325;USB PC Camera (SNPSTD325);c:\windows\system32\drivers\snp325.sys [1/13/2009 3:00 AM 451456]
.
Contents of the 'Scheduled Tasks' folder
2010-02-04 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 19:34]
.
.
------- Supplementary Scan -------
.
uSearchMigratedDefaultURL =
hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = <local>
uSearchURL,(Default) =
hxxp://www.google.com/search?q=%s
IE: &AIM Toolbar Search - c:\documents and settings\All Users\Application Data\AIM Toolbar\ieToolbar\resources\en-US\local\search.html
DPF: {94E5218F-9737-4FC2-8457-567B1FF23DC0} -
hxxp://utilities.pcpitstop.com/DiskMD3/DiskMD3Ctrl.dllFF - ProfilePath - c:\documents and settings\Francine Fua\Application Data\Mozilla\Firefox\Profiles\qw1zkkxo.default\
FF - component: c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\components\coFFPlgn.dll
FF - component: c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\IPSFFPlgn\components\IPSFFPl.dll
FF - plugin: c:\documents and settings\Francine Fua\Application Data\Move Networks\plugins\npqmp071505000011.dll
FF - plugin: c:\documents and settings\Francine Fua\Application Data\Move Networks\plugins\npqmp071701000002.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
---- FIREFOX POLICIES ----
.
- - - - ORPHANS REMOVED - - - -
AddRemove-WebCyberCoach_wtrb - c:\program files\WebCyberCoach\b_Dell\WCC_Wipe.exe WebCyberCoach ext\wtrb
AddRemove-PCM - c:\documents and settings\Francine Fua\Desktop\PCM\Uninstal.exe
**************************************************************************
scanning hidden processes ...
scanning hidden autostart entries ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
DLCGCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\DLCGtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
scanning hidden files ...
scan completed successfully
hidden files:
**************************************************************************
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer,
http://www.gmer.netdevice: opened successfully
user: MBR read successfully
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xba0ecf28
\Driver\ACPI -> 0x89343ef8
\Driver\atapi -> atapi.sys @ 0xb9f11852
IoDeviceObjectType ->\Device\Harddisk0\DR0 ->NDIS: Broadcom 440x 10/100 Integrated Controller -> SendCompleteHandler -> 0x894e1330
PacketIndicateHandler -> NDIS.sys @ 0xb9db3a21
SendHandler -> NDIS.sys @ 0xb9d9187b
Warning: possible MBR rootkit infection !
copy of MBR has been found in sector 0x0923CA09
malicious code @ sector 0x0923CA0C !
PE file found in sector at 0x0923CA22 !
MBR rootkit infection detected ! Use: "mbr.exe -f" to fix.
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\N360]
"ImagePath"="\"c:\program files\Norton Security Suite\Engine\3.8.0.41\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files\Norton Security Suite\Engine\3.8.0.41\diMaster.dll\" /prefetch:1"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(1420)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2010-03-15 22:26:07
ComboFix-quarantined-files.txt 2010-03-16 05:26
Pre-Run: 30,456,446,976 bytes free
Post-Run: 30,398,476,288 bytes free
- - End Of File - - 6A31E2FE1C601CBD9327C469E6280EA2