Reposting for screen317: Problems with laptop

superwow_rl · November 12, 2012

(This got deleted a while back when there was a problem with the servers here on the forums. I'm just now getting a chance to repost. User screen317 was assisting me when the thread got deleted. I have sent him a link to this thread.)

We were in the process of ruling out any kind of malware. Suspect I may just need a new computer.

Issues: Slow, Flash player freezing & crashing often, even though I just updated to the newest version, can't install or use some programs like Kaspersky or Spywareblaster, often get the error message that I don't have permissions to access files & folders. Always have a zillion (ok, not a zillion) svchost.exe processes running.

Actions: Have run Norton, Malwarebytes, Ccleaner, nothing of interest found. Have used PC Pitstop to try to find fixes but hasn't helped much.

Turned off my Norton Auto-Protect to run the scan, don't know if it makes a difference or not!

DDS (Ver_2012-10-19.01) - NTFS_x86

Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 10.9.2

Run by mom's toy at 12:48:43 on 2012-11-12

Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1252.1.1033.18.2813.1264 [GMT -7:00]

.

AV: Norton 360 *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Norton 360 *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}

FW: Norton 360 *Enabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}

.

============== Running Processes ================

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\Ati2evxx.exe

C:\Windows\system32\SLsvc.exe

C:\Windows\system32\Ati2evxx.exe

C:\Windows\system32\WLANExt.exe

C:\Windows\System32\spoolsv.exe

C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe

C:\Program Files\Acer\Empowering Technology\Service\ETService.exe

C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe

C:\Program Files\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe

C:\Program Files\Norton Management\Engine\3.2.0.19\ccSvcHst.exe

C:\Program Files\Norton 360\Engine\20.2.0.19\ccSvcHst.exe

C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe

C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\Norton 360\Engine\20.2.0.19\ccSvcHst.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\Norton Management\Engine\3.2.0.19\ccSvcHst.exe

C:\Windows\system32\DllHost.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Mozilla Firefox\plugin-container.exe

C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_5_502_110.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k rpcss

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k GPSvcGroup

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\svchost.exe -k hpdevmgmt

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\system32\svchost.exe -k imgsvc

C:\Windows\System32\svchost.exe -k WerSvcGroup

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\System32\svchost.exe -k swprv

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.swagbucks.com/

mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&s=2&o=vb32&d=1208&m=aspire_5515

BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - <orphaned>

BHO: HP Print Enhancer: {0347C33E-8762-4905-BF09-768834316C61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll

BHO: Virtual Account Numbers Helper: {17424104-1444-4810-85D7-B4DA413C5A9A} - c:\program files\virtual account numbers\CitiVANHelper.dll

BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Norton Identity Protection: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - c:\program files\norton 360\engine\20.2.0.19\coieplg.dll

BHO: Norton Vulnerability Protection: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - c:\program files\norton 360\engine\20.2.0.19\ips\ipsbho.dll

BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dll

BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre7\bin\jp2ssv.dll

BHO: SimpleAdblock Class: {FFCB3198-32F3-4E8B-9539-4324694ED664} - c:\program files\common files\simple adblock\SimpleAdblock.dll

BHO: HP Smart BHO Class: {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll

TB: Virtual Account Numbers: {7A21A046-B886-4A62-9D69-EF2059B0A27B} - c:\program files\virtual account numbers\CitiVANToolbar.dll

TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - c:\program files\norton 360\engine\20.2.0.19\coieplg.dll

EB: {4A62FAC4-1670-430B-8C6B-9C7B53F51798} - <orphaned>

EB: HP Smart Web Printing: {555D4D79-4BD2-4094-A395-CFC534424A05} - c:\program files\hp\digital imaging\smart web printing\hpswp_bho.dll

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

uPolicies-Explorer: NoDrives = dword:0

mPolicies-Explorer: BindDirectlyToPropertySetStorage = dword:0

mPolicies-Explorer: NoDrives = dword:0

mPolicies-System: EnableUIADesktopToggle = dword:0

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}

IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll

.

INFO: HKCU has more than 50 listed domains.

If you wish to scan all of them, select the 'Force scan all domains' option.

.

INFO: HKLM has more than 50 listed domains.

If you wish to scan all of them, select the 'Force scan all domains' option.

.

DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab

DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} - hxxp://utilities.pcpitstop.com/PCMagnum/controls/PCPitstop2.dll

TCP: NameServer = 216.136.95.2 64.163.94.250

TCP: Interfaces\{1D69327A-41BE-45F5-9F83-B01C419E94E5} : DHCPNameServer = 192.168.1.254

TCP: Interfaces\{D00B9979-42B9-4910-94EB-250C116767D1} : DHCPNameServer = 216.136.95.2 64.163.94.250

LSA: Security Packages = kerberos msv1_0 schannel wdigest tspkg

mASetup: {A509B1FF-37FF-4bFF-8CFF-4F3A747040FF} - c:\windows\system32\rundll32.exe c:\windows\system32\advpack.dll,launchinfsectionex c:\program files\internet explorer\clrtour.inf,DefaultInstall.ResetTour,,12

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\users\mom's toy\appdata\roaming\mozilla\firefox\profiles\ppe7dvih.default-1345356610650\

FF - prefs.js: browser.search.selectedEngine - Swagbucks

FF - prefs.js: browser.startup.homepage - hxxp://www.swagbucks.com/

FF - prefs.js: network.proxy.type - 0

FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll

FF - plugin: c:\program files\emusic download manager\plugin\npemusic.dll

FF - plugin: c:\program files\java\jre7\bin\plugin2\npjp2.dll

FF - plugin: c:\program files\mozilla firefox\plugins\NPcol400.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npOGAPlugin.dll

FF - plugin: c:\windows\system32\adobe\director\np32dsw_1166636.dll

FF - plugin: c:\windows\system32\adobe\director\np32dsw_1167637.dll

FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_5_502_110.dll

FF - plugin: c:\windows\system32\npDeployJava1.dll

FF - plugin: c:\windows\system32\npmproxy.dll

FF - ExtSQL: 2012-11-10 10:53; {2D3F3651-74B9-4795-BDEC-6DA2F431CB62}; c:\programdata\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_20.1.1.2\coFFPlgn

FF - ExtSQL: !HIDDEN! 2010-06-06 14:08; smartwebprinting@hp.com; c:\program files\hp\digital imaging\smart web printing\MozillaAddOn3

.

============= SERVICES / DRIVERS ===============

.

R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\n360\1402000.013\symds.sys [2012-10-25 368288]

R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\n360\1402000.013\symefa.sys [2012-10-25 927904]

R1 BHDrvx86;BHDrvx86;c:\programdata\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_20.1.1.2\definitions\bashdefs\20121030.002\BHDrvx86.sys [2012-11-5 995488]

R1 ccSet_MCLIENT;Norton Management Settings Manager;c:\windows\system32\drivers\mclient\0302000.013\ccsetx86.sys [2012-10-26 134304]

R1 ccSet_N360;Norton 360 Settings Manager;c:\windows\system32\drivers\n360\1402000.013\ccsetx86.sys [2012-10-25 134304]

R1 IDSVix86;IDSVix86;c:\programdata\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_20.1.1.2\definitions\ipsdefs\20121109.001\IDSvix86.sys [2012-11-9 386720]

R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\n360\1402000.013\ironx86.sys [2012-10-25 175264]

R1 SYMTDIv;Symantec Vista Network Dispatch Driver;c:\windows\system32\drivers\n360\1402000.013\symtdiv.sys [2012-10-25 350368]

R2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\common files\adobe\arm\1.0\armsvc.exe [2012-7-27 63960]

R2 BUNAgentSvc;NTI Backup Now 5 Agent Service;c:\program files\newtech infosystems\nti backup now 5\client\Agentsvc.exe [2008-3-3 16384]

R2 ETService;Empowering Technology Service;c:\program files\acer\empowering technology\service\ETService.exe [2008-12-13 24576]

R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 21504]

R2 KSS;Kaspersky Security Scan Service;"c:\program files\kaspersky lab\kaspersky security scan 2.0\kss.exe" -r --> c:\program files\kaspersky lab\kaspersky security scan 2.0\kss.exe [?]

R2 MCLIENT;Norton Management;c:\program files\norton management\engine\3.2.0.19\ccsvchst.exe [2012-10-26 143928]

R2 N360;Norton 360;c:\program files\norton 360\engine\20.2.0.19\ccsvchst.exe [2012-10-25 143928]

R2 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\newtech infosystems\nti backup now 5\BackupSvc.exe [2008-4-25 45056]

R2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\newtech infosystems\nti backup now 5\SchedulerSvc.exe [2008-4-25 131072]

R2 regi;regi;c:\windows\system32\drivers\regi.sys [2007-4-17 11032]

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2012-10-8 106656]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-11-11 250808]

S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\mozilla maintenance service\maintenanceservice.exe [2012-8-8 115168]

S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [2008-5-6 11520]

S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]

.

=============== Created Last 30 ================

.

2012-11-12 05:55:59 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2012-11-12 05:55:59 697272 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2012-11-09 17:36:41 6918632 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{c6048bc1-7b26-41f4-a880-f038a690d8ae}\mpengine.dll

2012-10-28 02:52:28 -------- d-sh--w- C:\$RECYCLE.BIN

2012-10-28 02:52:20 -------- d-----w- c:\users\mom's toy\appdata\local\temp

2012-10-28 02:25:05 98816 ----a-w- c:\windows\sed.exe

2012-10-28 02:25:05 256000 ----a-w- c:\windows\PEV.exe

2012-10-28 02:25:05 208896 ----a-w- c:\windows\MBR.exe

2012-10-27 06:47:59 96224 ----a-w- c:\program files\mozilla firefox\updated\nssdbm3.dll

2012-10-26 08:31:49 134304 ----a-w- c:\windows\system32\drivers\mclient\0302000.013\ccsetx86.sys

2012-10-26 08:31:45 -------- d-----w- c:\windows\system32\drivers\mclient\0302000.013

2012-10-26 02:01:46 927904 ----a-w- c:\windows\system32\drivers\n360\1402000.013\symefa.sys

2012-10-26 02:01:46 350368 ----a-w- c:\windows\system32\drivers\n360\1402000.013\symtdiv.sys

2012-10-26 02:01:46 338592 ----a-w- c:\windows\system32\drivers\n360\1402000.013\symnets.sys

2012-10-26 02:01:46 21400 ----a-r- c:\windows\system32\drivers\n360\1402000.013\symelam.sys

2012-10-26 02:01:45 586400 ----a-w- c:\windows\system32\drivers\n360\1402000.013\srtsp.sys

2012-10-26 02:01:45 368288 ----a-w- c:\windows\system32\drivers\n360\1402000.013\symds.sys

2012-10-26 02:01:45 32888 ----a-r- c:\windows\system32\drivers\n360\1402000.013\srtspx.sys

2012-10-26 02:01:45 175264 ----a-w- c:\windows\system32\drivers\n360\1402000.013\ironx86.sys

2012-10-26 02:01:45 134304 ----a-w- c:\windows\system32\drivers\n360\1402000.013\ccsetx86.sys

2012-10-26 02:01:22 9103 ----a-w- c:\windows\system32\drivers\n360\1402000.013\symvtcer.dat

2012-10-26 02:01:22 -------- d-----w- c:\windows\system32\drivers\n360\1402000.013

2012-10-20 19:10:06 93672 ----a-w- c:\windows\system32\WindowsAccessBridge.dll

2012-10-19 22:48:14 -------- d-----w- c:\program files\Kaspersky Lab

.

==================== Find3M ====================

.

2012-09-30 01:54:26 22856 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-09-21 04:33:06 142496 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS

2012-09-13 13:28:08 2048 ----a-w- c:\windows\system32\tzres.dll

2012-09-06 03:52:56 821736 ----a-w- c:\windows\system32\npDeployJava1.dll

2012-09-06 03:52:56 746984 ----a-w- c:\windows\system32\deployJava1.dll

2012-08-29 11:27:41 3602816 ----a-w- c:\windows\system32\ntkrnlpa.exe

2012-08-29 11:27:41 3550080 ----a-w- c:\windows\system32\ntoskrnl.exe

2012-08-24 15:53:29 172544 ----a-w- c:\windows\system32\wintrust.dll

2012-08-24 06:59:17 1800704 ----a-w- c:\windows\system32\jscript9.dll

2012-08-24 06:51:27 1129472 ----a-w- c:\windows\system32\wininet.dll

2012-08-24 06:51:02 1427968 ----a-w- c:\windows\system32\inetcpl.cpl

2012-08-24 06:47:26 142848 ----a-w- c:\windows\system32\ieUnatt.exe

2012-08-24 06:47:12 420864 ----a-w- c:\windows\system32\vbscript.dll

2012-08-24 06:43:58 2382848 ----a-w- c:\windows\system32\mshtml.tlb

2012-08-23 20:48:58 319456 ----a-w- c:\windows\DIFxAPI.dll

2012-08-21 19:01:22 26840 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys

2012-08-21 19:01:22 106928 ----a-w- c:\windows\system32\GEARAspi.dll

2012-08-09 18:20:09 3255248 ----a-w- c:\program files\spywareblastersetup46.exe

.

============= FINISH: 12:49:10.83 ===============

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2012-10-19.01)

.

Microsoft® Windows Vista™ Home Basic

Boot Device: \Device\HarddiskVolume2

Install Date: 12/13/2008 1:01:52 PM

System Uptime: 11/12/2012 9:03:44 AM (3 hours ago)

.

Motherboard: Acer | | Nile

Processor: AMD Athlon Processor 2650e | Socket M2/S1G1 | 1600/200mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 70 GiB total, 24.817 GiB free.

D: is FIXED (NTFS) - 70 GiB total, 69.155 GiB free.

E: is CDROM ()

.

==== Disabled Device Manager Items =============

.

==== System Restore Points ===================

.

RP720: 10/26/2012 3:36:00 AM - Scheduled Checkpoint

RP721: 10/28/2012 2:15:57 PM - Scheduled Checkpoint

RP722: 10/30/2012 2:15:17 PM - Windows Update

RP723: 11/3/2012 7:46:24 PM - Windows Update

RP724: 11/9/2012 10:29:16 AM - Windows Update

RP725: 11/10/2012 1:19:45 PM - Scheduled Checkpoint

.

==== Installed Programs ======================

.

32 Bit HP CIO Components Installer

3600_Help

Acer Assist

Acer Empowering Technology

Acer eRecovery Management

Acer Registration

Adobe AIR

Adobe Flash Player 11 Plugin

Adobe Reader X (10.1.4)

Adobe Shockwave Player 11.6

Apple Application Support

Apple Mobile Device Support

Apple Software Update

ATI Catalyst Install Manager

Auslogics Disk Defrag

Bonjour

BPD_Scan

BPDSoftware

BPDSoftware_Ini

BufferChm

Catalyst Control Center Core Implementation

Catalyst Control Center Graphics Full Existing

Catalyst Control Center Graphics Full New

Catalyst Control Center Graphics Light

Catalyst Control Center Graphics Previews Vista

Catalyst Control Center InstallProxy

Catalyst Control Center Localization Chinese Standard

Catalyst Control Center Localization Chinese Traditional

Catalyst Control Center Localization Czech

Catalyst Control Center Localization Danish

Catalyst Control Center Localization Dutch

Catalyst Control Center Localization Finnish

Catalyst Control Center Localization French

Catalyst Control Center Localization German

Catalyst Control Center Localization Greek

Catalyst Control Center Localization Hungarian

Catalyst Control Center Localization Italian

Catalyst Control Center Localization Japanese

Catalyst Control Center Localization Korean

Catalyst Control Center Localization Norwegian

Catalyst Control Center Localization Polish

Catalyst Control Center Localization Portuguese

Catalyst Control Center Localization Russian

Catalyst Control Center Localization Spanish

Catalyst Control Center Localization Swedish

Catalyst Control Center Localization Thai

Catalyst Control Center Localization Turkish

ccc-core-static

ccc-utility

CCC Help Chinese Standard

CCC Help Chinese Traditional

CCC Help Czech

CCC Help Danish

CCC Help Dutch

CCC Help English

CCC Help Finnish

CCC Help French

CCC Help German

CCC Help Greek

CCC Help Hungarian

CCC Help Italian

CCC Help Japanese

CCC Help Korean

CCC Help Norwegian

CCC Help Polish

CCC Help Portuguese

CCC Help Russian

CCC Help Spanish

CCC Help Swedish

CCC Help Thai

CCC Help Turkish

Compatibility Pack for the 2007 Office system

CustomerResearchQFolder

Destinations

DeviceManagementQFolder

DocProc

DocProcQFolder

eMusic Download Manager 4.1.4

eSupportQFolder

Fax

Google Update Helper

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)

HP Customer Participation Program 8.0

HP Imaging Device Functions 8.0

HP OCR Software 8.0

HP Officejet J3600 Series

HP Photosmart Essential

HP Product Assistant

HP Smart Web Printing 4.60

HP Solution Center 8.0

HP Update

HPProductAssistant

HPSSupply

InterVideo WinDVD 8

iTunes

J3600

Java 7 Update 9

Java Auto Updater

Kaspersky Security Scan

Launch Manager

LightScribe 1.4.142.1

Malwarebytes Anti-Malware version 1.65.1.1000

MarketResearch

Microsoft .NET Framework 3.5 SP1

Microsoft .NET Framework 4 Client Profile

Microsoft .NET Framework 4 Extended

Microsoft Application Error Reporting

Microsoft IntelliPoint 6.2

Microsoft Office File Validation Add-In

Microsoft Office Professional Edition 2003

Microsoft Office Suite Activation Assistant

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

Microsoft Visual C++ 2005 Redistributable

Mozilla Firefox 16.0.2 (x86 en-US)

Mozilla Maintenance Service

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

MSXML 4.0 SP2 and SOAP Toolkit 3.0

Norton 360

Norton Management

NTI Backup Now 5

NTI Backup Now Standard

NTI Media Maker 8

OGA Notifier 2.0.0048.0

ProductContext

QuickTime

Realtek 8169 8168 8101E 8102E Ethernet Driver

Realtek High Definition Audio Driver

Rhapsody

Scan

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111)

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)

Security Update for Microsoft .NET Framework 4 Extended (KB2487367)

Security Update for Microsoft .NET Framework 4 Extended (KB2656351)

Simple Adblock

Skins

SmartWebPrinting

SolutionCenter

Status

swMSM

Synaptics Pointing Device Driver

Toolbox

TrayApp

Update for Microsoft .NET Framework 3.5 SP1 (KB963707)

Update for Microsoft .NET Framework 4 Client Profile (KB2468871)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523)

Update for Microsoft .NET Framework 4 Client Profile (KB2600217)

Update for Microsoft .NET Framework 4 Extended (KB2468871)

Update for Microsoft .NET Framework 4 Extended (KB2533523)

Update for Microsoft .NET Framework 4 Extended (KB2600217)

Virtual Account Numbers

WebReg

World's Best Word Games

Yahoo! Messenger

Yahoo! Software Update

.

==== Event Viewer Messages From Past Week ========

.

11/9/2012 5:07:34 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Netman service.

11/9/2012 10:11:47 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the NlaSvc service.

11/8/2012 5:01:45 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the ETService service.

11/12/2012 10:31:19 AM, Error: Schannel [36874] - An SSL connection request was received from a remote client application, but none of the cipher suites supported by the client application are supported by the server. The SSL connection request has failed.

11/11/2012 11:44:18 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the KSS service.

11/11/2012 10:53:40 PM, Error: Service Control Manager [7000] - The Parallel port driver service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.

11/11/2012 10:52:06 PM, Error: volmgr [49] - Configuring the Page file for crash dump failed. Make sure there is a page file on the boot partition and that is large enough to contain all physical memory.

.

==== End Of File ===========================

screen317 · November 12, 2012

Hi superwow_rl,

Let's look for malware again, just to be sure.

Please update MBAM, run a Quick Scan, and post its log.

Next, please visit this webpage for instructions for running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

When the tool is finished, it will produce a report for you.
Please post the C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system.

-screen317

superwow_rl · November 13, 2012

Malwarebytes Anti-Malware 1.65.1.1000

www.malwarebytes.org

Database version: v2012.11.12.07

Windows Vista Service Pack 2 x86 NTFS

Internet Explorer 9.0.8112.16421

mom's toy :: NIPPERS [administrator]

11/12/2012 1:47:38 PM

mbam-log-2012-11-12 (13-47-38).txt

Scan type: Quick scan

Scan options disabled:

Objects scanned: 230146

Time elapsed: 10 minute(s), 55 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

(end)

At about Stage 30 of ComboFix, Windows popped up saying PEV.exe was not working, & had to be closed. I waited until all 50 stages were done, & I was waiting for the log to pop up, when I finally clicked OK on the Windows box to close the PEV error. I don't know how that affects the scan, but nothing would open until I restarted my computer. Every icon I clicked on, I got an error message saying "Illegal operation, Registry key has been marked for deletion" (or something really similar). I had to restart, & then run DDS.

ComboFix 12-11-12.03 - mom's toy 11/12/2012 17:57:34.3.1 - x86

Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1252.1.1033.18.2813.1780 [GMT -7:00]

Running from: c:\users\mom's toy\Desktop\ComboFix.exe

AV: Norton 360 *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}

FW: Norton 360 *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}

SP: Norton 360 *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((( Files Created from 2012-10-13 to 2012-11-13 )))))))))))))))))))))))))))))))

.

2012-11-13 01:09 . 2012-11-13 01:09 -------- d-----w- c:\users\Public\AppData\Local\temp

2012-11-13 01:09 . 2012-11-13 01:09 -------- d-----w- c:\users\mom's toy\AppData\Local\temp

2012-11-13 01:09 . 2012-11-13 01:09 -------- d-----w- c:\users\Default\AppData\Local\temp

2012-11-13 01:09 . 2012-11-13 01:09 -------- d-----w- c:\users\Administrator\AppData\Local\temp

2012-11-12 05:55 . 2012-11-12 05:55 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2012-11-12 05:55 . 2012-11-12 05:55 697272 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2012-11-09 17:36 . 2012-10-17 08:32 6918632 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{C6048BC1-7B26-41F4-A880-F038A690D8AE}\mpengine.dll

2012-10-27 06:47 . 2012-10-13 01:26 2106216 ----a-w- c:\program files\Mozilla Firefox\updated\D3DCompiler_43.dll

2012-10-27 06:47 . 2012-10-13 01:26 1998168 ----a-w- c:\program files\Mozilla Firefox\updated\d3dx9_43.dll

2012-10-27 06:47 . 2012-10-13 01:26 770384 ----a-w- c:\program files\Mozilla Firefox\updated\msvcr100.dll

2012-10-27 06:47 . 2012-10-13 01:26 421200 ----a-w- c:\program files\Mozilla Firefox\updated\msvcp100.dll

2012-10-27 06:47 . 2009-02-24 00:59 7521112 ----a-w- c:\program files\Mozilla Firefox\updated\Firefox Setup 3.0.6.exe

2012-10-27 06:47 . 2012-10-27 06:48 73696 ----a-w- c:\program files\Mozilla Firefox\updated\breakpadinjector.dll

2012-10-27 06:47 . 2012-10-27 06:48 261600 ----a-w- c:\program files\Mozilla Firefox\updated\components\browsercomps.dll

2012-10-27 06:47 . 2012-10-27 06:48 18912 ----a-w- c:\program files\Mozilla Firefox\updated\AccessibleMarshal.dll

2012-10-27 06:47 . 2012-10-27 06:48 116192 ----a-w- c:\program files\Mozilla Firefox\updated\crashreporter.exe

2012-10-26 08:31 . 2012-10-26 08:31 -------- d-----w- c:\windows\system32\drivers\MCLIENT\0302000.013

2012-10-26 02:01 . 2012-10-26 04:59 -------- d-----w- c:\windows\system32\drivers\N360\1402000.013

2012-10-20 19:10 . 2012-09-25 05:16 93672 ----a-w- c:\windows\system32\WindowsAccessBridge.dll

2012-10-19 22:48 . 2012-10-19 22:48 -------- d-----w- c:\program files\Kaspersky Lab

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-09-30 01:54 . 2011-06-02 23:58 22856 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-09-21 04:33 . 2009-10-11 04:23 142496 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS

2012-09-13 13:28 . 2012-10-10 05:59 2048 ----a-w- c:\windows\system32\tzres.dll

2012-09-06 03:52 . 2012-06-14 20:58 821736 ----a-w- c:\windows\system32\npDeployJava1.dll

2012-09-06 03:52 . 2010-04-19 14:19 746984 ----a-w- c:\windows\system32\deployJava1.dll

2012-08-29 11:27 . 2012-10-10 05:57 3602816 ----a-w- c:\windows\system32\ntkrnlpa.exe

2012-08-29 11:27 . 2012-10-10 05:57 3550080 ----a-w- c:\windows\system32\ntoskrnl.exe

2012-08-24 15:53 . 2012-10-10 05:59 172544 ----a-w- c:\windows\system32\wintrust.dll

2012-08-24 06:59 . 2012-09-22 00:54 1800704 ----a-w- c:\windows\system32\jscript9.dll

2012-08-24 06:51 . 2012-09-22 00:54 1129472 ----a-w- c:\windows\system32\wininet.dll

2012-08-24 06:51 . 2012-09-22 00:54 1427968 ----a-w- c:\windows\system32\inetcpl.cpl

2012-08-24 06:47 . 2012-09-22 00:54 142848 ----a-w- c:\windows\system32\ieUnatt.exe

2012-08-24 06:47 . 2012-09-22 00:54 420864 ----a-w- c:\windows\system32\vbscript.dll

2012-08-24 06:43 . 2012-09-22 00:54 2382848 ----a-w- c:\windows\system32\mshtml.tlb

2012-08-23 20:48 . 2008-12-04 12:31 319456 ----a-w- c:\windows\DIFxAPI.dll

2012-08-21 19:01 . 2012-09-15 22:02 26840 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys

2012-08-21 19:01 . 2009-10-11 04:23 106928 ----a-w- c:\windows\system32\GEARAspi.dll

2012-08-09 18:20 . 2012-08-09 18:20 3255248 ----a-w- c:\program files\spywareblastersetup46.exe

2012-10-27 17:53 . 2012-08-08 18:29 261600 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]

path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk

backup=c:\windows\pss\HP Digital Imaging Monitor.lnk.CommonStartup

backupExtension=.CommonStartup

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acer Assist Launcher]

2007-11-19 22:17 1261568 ----a-w- c:\program files\Acer\Acer Assist\launcher.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APSDaemon]

2012-08-28 03:32 59280 ----a-w- c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BkupTray]

2008-04-26 05:36 28672 ----a-w- c:\program files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]

2006-12-11 03:52 49152 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelliPoint]

2007-08-31 19:01 1037736 ----a-w- c:\program files\Microsoft IntelliPoint\ipoint.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

2012-09-10 05:30 421776 ----a-w- c:\program files\iTunes\iTunesHelper.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LManager]

2008-07-23 03:05 846344 ----a-w- c:\progra~1\LAUNCH~1\LManager.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]

2008-01-21 20:17 61440 ----a-w- c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]

2008-02-22 03:50 1037608 ----a-w- c:\program files\Synaptics\SynTP\SynTPEnh.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]

"DisableMonitoring"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]

"DisableMonitoring"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc

LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

.

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]

2011-03-25 17:18 114176 ----a-w- c:\windows\System32\advpack.dll

.

Contents of the 'Scheduled Tasks' folder

.

2012-11-13 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-11-12 05:55]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.swagbucks.com/

mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&s=2&o=vb32&d=1208&m=aspire_5515

uInternet Settings,ProxyOverride = *.local

TCP: DhcpNameServer = 192.168.1.254

FF - ProfilePath - c:\users\mom's toy\AppData\Roaming\Mozilla\Firefox\Profiles\ppe7dvih.default-1345356610650\

FF - prefs.js: browser.search.selectedEngine - Swagbucks

FF - prefs.js: browser.startup.homepage - hxxp://www.swagbucks.com/

FF - prefs.js: network.proxy.type - 0

FF - ExtSQL: 2012-11-10 10:53; {2D3F3651-74B9-4795-BDEC-6DA2F431CB62}; c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.1.2\coFFPlgn

FF - ExtSQL: !HIDDEN! 2010-06-06 14:08; smartwebprinting@hp.com; c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2012-11-12 18:10

Windows 6.0.6002 Service Pack 2 NTFS

.

scanning hidden processes ...

.

[0] 0x418B2404

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\MCLIENT]

"ImagePath"="\"c:\program files\Norton Management\Engine\3.2.0.19\ccSvcHst.exe\" /s \"MCLIENT\" /m \"c:\program files\Norton Management\Engine\3.2.0.19\diMaster.dll\" /prefetch:1"

--

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\N360]

"ImagePath"="\"c:\program files\Norton 360\Engine\20.2.0.19\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files\Norton 360\Engine\20.2.0.19\diMaster.dll\" /prefetch:1"

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]

@Denied: (2) (LocalSystem)

"{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}"=hex:51,66,7a,6c,4c,1d,38,12,8d,ec,f8,

7b,2b,25,27,06,e7,c4,bc,f0,98,15,0d,de

"{7A21A046-B886-4A62-9D69-EF2059B0A27B}"=hex:51,66,7a,6c,4c,1d,38,12,28,a3,32,

7e,b4,f6,0c,0f,e2,7f,ac,60,5c,ee,e6,6f

"{2318C2B1-4965-11D4-9B18-009027A5CD4F}"=hex:51,66,7a,6c,4c,1d,38,12,df,c1,0b,

27,57,07,ba,54,e4,0e,43,d0,22,fb,89,5b

"{EF99BD32-C1FB-11D2-892F-0090271D4F88}"=hex:51,66,7a,6c,4c,1d,38,12,5c,be,8a,

eb,c9,8f,bc,54,f6,39,43,d0,22,43,0b,9c

"{D84A64A0-F2B2-4975-B264-3A3BCE8D57D6}"=hex:51,66,7a,6c,4c,1d,38,12,ce,67,59,

dc,80,bc,1b,0c,cd,72,79,7b,cb,d3,13,c2

"{02478D38-C3F9-4EFB-9B51-7695ECA05670}"=hex:51,66,7a,6c,4c,1d,38,12,56,8e,54,

06,cb,8d,95,0b,e4,47,35,d5,e9,fe,12,64

"{0347C33E-8762-4905-BF09-768834316C61}"=hex:51,66,7a,6c,4c,1d,38,12,50,c0,54,

07,50,c9,6b,0c,c0,1f,35,c8,31,6f,28,75

"{17424104-1444-4810-85D7-B4DA413C5A9A}"=hex:51,66,7a,6c,4c,1d,38,12,6a,42,51,

13,76,5a,7e,0d,fa,c1,f7,9a,44,62,1e,8e

"{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc,

1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7

"{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}"=hex:51,66,7a,6c,4c,1d,38,12,60,d8,39,

64,cd,04,79,07,f5,b7,d6,9a,c1,81,e0,1c

"{6D53EC84-6AAE-4787-AEEE-F4628F01010C}"=hex:51,66,7a,6c,4c,1d,38,12,ea,ef,40,

69,9c,24,e9,02,d1,f8,b7,22,8a,5f,45,18

"{AA58ED58-01DD-4D91-8333-CF10577473F7}"=hex:51,66,7a,6c,4c,1d,38,12,36,ee,4b,

ae,ef,4f,ff,08,fc,25,8c,50,52,2a,37,e3

"{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}"=hex:51,66,7a,6c,4c,1d,38,12,2d,dd,7a,

ab,6a,33,56,03,c9,ec,8d,26,b0,f3,64,49

"{D93EC24D-8741-4D41-B83D-A5793B998416}"=hex:51,66,7a,6c,4c,1d,38,12,23,c1,2d,

dd,73,c9,2f,08,c7,2b,e6,39,3e,c7,c0,02

"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,

df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd

"{E08861FE-8847-4B2A-8EC2-08EDB20E4020}"=hex:51,66,7a,6c,4c,1d,38,12,90,62,9b,

e4,75,c6,44,0e,f1,d4,4b,ad,b7,50,04,34

"{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}"=hex:51,66,7a,6c,4c,1d,38,12,cf,4e,be,

f9,90,2f,b6,0a,e3,01,c5,b7,a9,7a,14,95

"{FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856}"=hex:51,66,7a,6c,4c,1d,38,12,91,fc,ec,

fb,7c,81,45,0a,c2,d4,4d,32,e4,48,ec,42

"{2E5E800E-6AC0-411E-940A-369530A35E43}"=hex:51,66,7a,6c,4c,1d,38,12,60,83,4d,

2a,f2,24,70,04,eb,1c,75,d5,35,fd,1a,57

"{32004B8A-44A9-43E7-84E9-808838809519}"=hex:51,66,7a,6c,4c,1d,38,12,e4,48,13,

36,9b,0a,89,06,fb,ff,c3,c8,3d,de,d1,0d

"{555D4D79-4BD2-4094-A395-CFC534424A05}"=hex:51,66,7a,6c,4c,1d,38,12,17,4e,4e,

51,e0,05,fa,05,dc,83,8c,85,31,1c,0e,11

"{FF059E31-CC5A-4E2E-BF3B-96E929D65503}"=hex:51,66,7a,6c,4c,1d,38,12,5f,9d,16,

fb,68,82,40,0b,c0,2d,d5,a9,2c,88,11,17

"{BDEADE7F-C265-11D0-BCED-00A0C90AB50F}"=hex:51,66,7a,6c,4c,1d,38,12,11,dd,f9,

b9,57,8c,be,54,c3,fb,43,e0,cc,54,f1,1b

.

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]

@Denied: (2) (LocalSystem)

"Timestamp"=hex:9d,a3,08,fe,4c,ee,cb,01

.

Completion time: 2012-11-12 18:14:35

ComboFix-quarantined-files.txt 2012-11-13 01:14

ComboFix2.txt 2012-10-28 02:52

ComboFix3.txt 2012-08-07 22:20

.

Pre-Run: 26,460,778,496 bytes free

Post-Run: 26,406,305,792 bytes free

.

- - End Of File - - 7D3CFCFBA7EA27266D310B833390A9C5

DDS (Ver_2012-10-19.01) - NTFS_x86

Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 10.9.2

Run by mom's toy at 18:22:45 on 2012-11-12

Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1252.1.1033.18.2813.1723 [GMT -7:00]

.

AV: Norton 360 *Enabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Norton 360 *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}

FW: Norton 360 *Enabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}

.

============== Running Processes ================

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\Ati2evxx.exe

C:\Windows\system32\SLsvc.exe

C:\Windows\system32\Ati2evxx.exe

C:\Windows\system32\WLANExt.exe

C:\Windows\System32\spoolsv.exe

C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe

C:\Program Files\Acer\Empowering Technology\Service\ETService.exe

C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe

C:\Program Files\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe

C:\Program Files\Norton Management\Engine\3.2.0.19\ccSvcHst.exe

C:\Program Files\Norton 360\Engine\20.2.0.19\ccSvcHst.exe

C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe

C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\taskeng.exe

C:\Windows\Explorer.EXE

C:\Windows\system32\Dwm.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Windows\system32\taskeng.exe

C:\Program Files\Norton 360\Engine\20.2.0.19\ccSvcHst.exe

C:\Windows\system32\DllHost.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Program Files\Norton Management\Engine\3.2.0.19\ccSvcHst.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Mozilla Firefox\plugin-container.exe

C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_5_502_110.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\NOTEPAD.EXE

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k rpcss

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k GPSvcGroup

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\svchost.exe -k hpdevmgmt

C:\Windows\System32\svchost.exe -k HPZ12