Computer freezes when try to run scan; HJT logs aattached

SAM1004 · March 1, 2009

Hi,

I have updated to the latest version of Malwarebytes, but still cannot run a scan. It gets stuck and freezes about one minute in while scanning "installer" folders. I have to shut off the computer to get out of it when it freezes. I cannot run a scan to attach logs. Any help would be appreciated!

Here is the HJT data:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 5:25:25 PM, on 3/1/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16791)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

C:\WINDOWS\system32\brsvc01a.exe

C:\WINDOWS\system32\brss01a.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\WINDOWS\arservice.exe

C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe

C:\WINDOWS\eHome\ehRecvr.exe

C:\WINDOWS\eHome\ehSched.exe

C:\Program Files\Pure Digital Technologies\FlipShare\FlipShareService.exe

C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe

C:\Program Files\iolo\common\lib\ioloServiceManager.exe

C:\Program Files\Common Files\LightScribe\LSSrvc.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Viewpoint\Common\ViewpointService.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\dllhost.exe

C:\WINDOWS\ehome\ehtray.exe

C:\WINDOWS\ARPWRMSG.EXE

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\WINDOWS\eHome\ehmsas.exe

C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

C:\Program Files\Logitech\MouseWare\system\em_exec.exe

C:\PROGRAM FILES\DELL\DELL LASER MFP 1815\PSU\Scan2Pc.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\Timex\Timex Trainer\TBEggLaunch.exe

C:\Program Files\CMS Products\BounceBack Express\BBLauncher.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\HP\KBD\KBD.EXE

C:\WINDOWS\ALCXMNTR.EXE

C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

c:\windows\system\hpsysdrv.exe

C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe

C:\Program Files\Java\jre1.5.0_05\bin\jucheck.exe

C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.5\coIEPlg.dll

O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll

O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll

O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll

O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll

O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.5\CoIEPlg.dll

O3 - Toolbar: AIM Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll

O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll

O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe

O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE

O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run

O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"

O4 - HKLM\..\Run: [MFP1815_S2P] C:\PROGRAM FILES\DELL\DELL LASER MFP 1815\PSU\Scan2Pc.exe

O4 - HKLM\..\Run: [sSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot

O4 - HKLM\..\Run: [PaperPort PTD] "C:\Program Files\DELL\Dell Laser MFP 1815\PaperPort\pptd40nt.exe"

O4 - HKLM\..\Run: [indexSearch] "C:\Program Files\DELL\Dell Laser MFP 1815\PaperPort\IndexSearch.exe"

O4 - HKLM\..\Run: [PPort10reminder] "C:\Program Files\DELL\Dell Laser MFP 1815\PaperPort\Ereg\Ereg.exe" -r "C:\Documents and Settings\All Users\Application Data\ScanSoft\PaperPort\10\Config\Ereg\ereg.ini"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9

O4 - HKCU\..\Run: [e

AdvancedSetup · March 2, 2009

Please visit this webpage for instructions for downloading ComboFix to your

DESKTOP

:

how-to-use-combofix

Please ensure you read this guide carefully and install the Recovery Console first.

NOTE!!:

You must save and run

ComboFix.exe

on your DESKTOP and not from any other folder.

Also,

DO NOT

click the mouse or launch any other applications while this is running or it may stall the program

Additional links to download the tool:

ComboFix.exe

Note:

The

Windows Recovery Console

will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Once installed, you should see a blue screen prompt that says:

The Recovery Console was successfully installed.

Please continue as follows:

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
Click
Yes
to allow ComboFix to continue scanning for malware.
When the tool is finished, it will produce a report for you.
Please post the
C:\ComboFix.txt
along with a
new HijackThis log
so we may continue cleaning the system.

SAM1004 · March 2, 2009

ComboFix 09-03-02.01 - HP_Administrator 2009-03-02 15:20:01.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.958.481 [GMT -5:00]

Running from: c:\documents and settings\HP_Administrator\Desktop\ComboFix.exe

AV: Norton Internet Security *On-access scanning disabled* (Updated)

FW: Norton Internet Security *enabled*

* Created a new restore point

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat

c:\documents and settings\HP_Administrator\Application Data\FunWebProducts

c:\documents and settings\HP_Administrator\Application Data\FunWebProducts\Data\HP_Administrator\avatar.dat

c:\windows\IE4 Error Log.txt

c:\windows\system32\AutoRun.inf

c:\windows\system32\DELG1LMK.DLL

D:\Autorun.inf

----- BITS: Possible infected sites -----

hxxp://download.esd.intuit.com

.

((((((((((((((((((((((((( Files Created from 2009-02-02 to 2009-03-02 )))))))))))))))))))))))))))))))

.

2009-03-01 17:17 . 2009-03-01 17:17 <DIR> d-------- c:\program files\Trend Micro

2009-02-21 16:08 . 2007-03-07 23:20 49,920 -r------- c:\windows\system32\drivers\HPZid412.sys

2009-02-21 16:08 . 2007-03-07 23:20 16,496 -r------- c:\windows\system32\drivers\HPZipr12.sys

2009-02-21 16:07 . 2007-03-07 23:20 21,568 -r------- c:\windows\system32\drivers\HPZius12.sys

2009-02-21 16:06 . 2007-11-01 21:28 970,752 --------- c:\windows\system32\hpotiop5.dll

2009-02-21 16:06 . 2007-11-01 21:28 729,088 --------- c:\windows\system32\hpowiax5.dll

2009-02-21 16:06 . 2007-11-01 21:28 364,544 --------- c:\windows\system32\hppldcoi.dll

2009-02-21 16:06 . 2007-11-01 21:28 309,760 --------- c:\windows\system32\difxapi.dll

2009-02-21 16:06 . 2007-11-01 21:28 303,104 --------- c:\windows\system32\hpovst12.dll

2009-02-21 16:04 . 2009-02-21 16:08 142,919 --------- c:\windows\hpoins21.dat

2009-02-21 16:04 . 2008-01-23 21:29 7,262 --------- c:\windows\hpomdl21.dat

2009-02-21 10:17 . 2009-02-21 10:17 <DIR> d-------- c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}

2009-02-19 12:03 . 2009-02-19 12:03 579,464 --------- c:\windows\system32\SymNeti.dll

2009-02-19 12:03 . 2009-02-19 12:03 207,240 --------- c:\windows\system32\SymRedir.dll

2009-02-19 11:31 . 2009-02-19 11:31 184,496 --------- c:\windows\system32\drivers\symtdi.sys

2009-02-19 11:31 . 2009-02-19 11:31 96,560 --------- c:\windows\system32\drivers\symfw.sys

2009-02-19 11:31 . 2009-02-19 11:31 41,008 --------- c:\windows\system32\drivers\symndisv.sys

2009-02-19 11:31 . 2009-02-19 11:31 38,576 --------- c:\windows\system32\drivers\symids.sys

2009-02-19 11:31 . 2009-02-19 11:31 37,424 --------- c:\windows\system32\drivers\symndis.sys

2009-02-19 11:31 . 2009-02-19 11:31 22,320 --------- c:\windows\system32\drivers\symredrv.sys

2009-02-19 11:31 . 2009-02-19 11:31 13,616 --------- c:\windows\system32\drivers\symdns.sys

2009-02-19 11:31 . 2009-02-19 11:31 9,844 --------- c:\windows\system32\drivers\SymRedir.cat

2009-02-19 11:31 . 2009-02-19 11:31 1,611 --------- c:\windows\system32\drivers\SymRedir.inf

2009-02-11 20:50 . 2009-02-11 20:50 <DIR> d-------- c:\documents and settings\HP_Administrator\Application Data\ScanSoft

2009-02-11 20:50 . 2009-02-11 21:03 91 --------- c:\windows\bi_group.ini

2009-02-10 13:41 . 2005-03-01 16:32 28,787 --------- c:\windows\maxlink.ini

2009-02-10 13:41 . 2009-02-10 13:42 33 --------- c:\windows\BiMonitor.ini

2009-02-10 13:40 . 2009-02-10 13:40 <DIR> d-------- c:\program files\Common Files\Scansoft Shared

2009-02-10 13:40 . 2009-02-10 13:41 <DIR> d-------- c:\documents and settings\All Users\Application Data\ScanSoft

2009-02-10 13:39 . 2003-04-18 16:29 44,544 --------- c:\windows\system32\msxml4a.dll

2009-02-10 13:39 . 2000-08-04 01:52 21,776 --------- c:\windows\system32\msxml2a.dll

2009-02-10 13:39 . 2003-11-07 09:46 766 --------- c:\windows\dellmfp.ico

2009-02-10 13:38 . 2006-01-18 02:01 73,728 -r------- c:\windows\wiainst.exe

2009-02-10 13:38 . 2001-03-18 13:52 766 --------- c:\windows\Uninstall.ico

2009-02-10 13:36 . 2009-02-10 13:36 <DIR> d-------- c:\program files\DELL

2009-02-10 13:36 . 2005-12-12 01:56 151,552 --------- c:\windows\system32\DELG1CI.exe

2009-02-10 13:36 . 2005-12-12 01:56 151,552 --------- c:\windows\system32\d1815ci.exe

2009-02-10 13:36 . 2005-12-12 01:57 135,168 --------- c:\windows\system32\VdSetup.Exe

2009-02-10 13:36 . 2005-12-12 01:56 135,168 --------- c:\windows\system32\SVSetup.Exe

2009-02-10 13:36 . 2005-12-12 01:57 57,344 --------- c:\windows\system32\DELG1CI.dll

2009-02-10 13:36 . 2005-12-12 01:57 57,344 --------- c:\windows\system32\d1815ci.dll

2009-02-10 13:36 . 2005-12-12 01:57 53,248 --------- c:\windows\system32\VdSetup.dll

2009-02-10 13:36 . 2005-12-12 01:57 53,248 --------- c:\windows\system32\SVSetup.dll

2009-02-10 13:36 . 2005-09-08 23:59 508 --------- c:\windows\system32\DELG1lmk.smt

2009-02-10 13:33 . 2006-04-18 21:12 94,208 --------- c:\windows\system32\WIAIPH.dll

2009-02-10 13:33 . 2006-01-31 19:11 86,016 --------- c:\windows\system32\WIAEH.dll

2009-02-10 13:33 . 2005-01-23 21:15 65,536 --------- c:\windows\system32\Ssdevm.dll

2009-02-10 13:33 . 2006-02-05 20:05 49,152 --------- c:\windows\system32\WIASTIIO.dll

2009-02-10 13:33 . 2006-02-05 20:06 49,152 --------- c:\windows\system32\Sswiadrv.dll

2009-02-10 13:33 . 2005-09-09 01:15 49,152 --------- c:\windows\system32\Ssusbpn.dll

2009-02-10 13:33 . 2006-01-31 19:12 36,864 -r------- c:\windows\system32\Ssuiext.dll

2009-02-10 13:33 . 2004-05-11 20:22 5,773 -r------- c:\windows\system32\WIAUISTR.loc

2009-02-10 12:40 . 2009-02-10 12:40 <DIR> d-------- C:\dell

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-03-02 20:27 --------- d-----w c:\program files\Common Files\Symantec Shared

2009-03-02 19:25 --------- d-----w c:\documents and settings\Grant & Griffin\Application Data\HPAppData

2009-02-21 21:15 --------- d-----w c:\program files\Malwarebytes' Anti-Malware

2009-02-21 20:29 --------- d-----w c:\program files\The Learning Company

2009-02-21 20:14 --------- d-----w c:\program files\Coupons

2009-02-21 15:17 --------- d-----w c:\program files\iTunes

2009-02-21 15:17 --------- d-----w c:\program files\iPod

2009-02-21 15:17 --------- d-----w c:\program files\Common Files\Apple

2009-02-21 15:14 --------- d-----w c:\program files\QuickTime

2009-02-19 16:31 31,280 ------w c:\windows\system32\drivers\SymIM.sys

2009-02-18 22:56 --------- d-----w c:\documents and settings\Grant & Griffin\Application Data\Apple Computer

2009-02-14 13:05 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec

2009-02-12 12:17 --------- d--h--w c:\program files\InstallShield Installation Information

2009-02-11 15:19 38,496 ------w c:\windows\system32\drivers\mbamswissarmy.sys

2009-02-11 15:19 15,504 ------w c:\windows\system32\drivers\mbam.sys

2009-01-29 20:12 --------- d-----w c:\program files\Common Files\AnswerWorks 5.0

2009-01-29 20:10 --------- d-----w c:\program files\Common Files\Intuit

2009-01-29 20:10 --------- d-----w c:\documents and settings\All Users\Application Data\Intuit

2009-01-29 20:07 --------- d-----w c:\program files\TurboTax

2009-01-26 16:53 --------- d-----w c:\documents and settings\LocalService\Application Data\iolo

2009-01-24 18:53 --------- d-----w c:\documents and settings\Grant & Griffin\Application Data\iolo

2009-01-23 13:37 --------- d-----w c:\documents and settings\HP_Administrator\Application Data\iolo

2009-01-23 00:25 --------- d-----w c:\program files\Microsoft Works

2009-01-23 00:24 --------- d-----w c:\program files\Microsoft ActiveSync

2009-01-23 00:24 --------- d-----w c:\program files\Common Files\L&H

2009-01-22 21:32 --------- d-----w c:\documents and settings\HP_Administrator\Application Data\HPAppData

2009-01-21 20:44 34 ------w c:\documents and settings\Grant & Griffin\jagex_runescape_preferences.dat

2009-01-18 20:55 --------- d-----w c:\program files\Virtual Earth 3D

2009-01-18 19:49 --------- d-----w c:\program files\Typing Instructor for Kids 3

2009-01-15 22:52 --------- d-----w c:\program files\AIMTunes

2009-01-11 17:54 --------- d-----w c:\documents and settings\Grant & Griffin\Application Data\LEGO Company

2009-01-10 21:33 --------- d-----w c:\program files\LEGO Company

2009-01-10 21:33 --------- d-----w c:\documents and settings\HP_Administrator\Application Data\LEGO Company

2009-01-09 14:48 806 ------w c:\windows\system32\drivers\SYMEVENT.INF

2009-01-09 14:48 124,464 ------w c:\windows\system32\drivers\SYMEVENT.SYS

2009-01-09 14:48 10,635 ------w c:\windows\system32\drivers\SYMEVENT.CAT

2009-01-09 14:48 --------- d-----w c:\program files\Symantec

2009-01-08 22:07 --------- d-----w c:\documents and settings\All Users\Application Data\Electronic Arts

2009-01-07 21:25 --------- d-----w c:\documents and settings\Grant & Griffin\Application Data\SPORE

2008-10-22 18:35 32 ------r c:\documents and settings\All Users\hash.dat

2006-04-07 12:15 533,704 ------w c:\program files\AdbeRdr707_DLM_en_US.exe

2005-09-29 21:54 73,728 ------w c:\documents and settings\Grant & Griffin\SlowAndSteadyAlice.exe

2005-09-29 21:54 73,728 ------w c:\documents and settings\Grant & Griffin\Alice.exe

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]

"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-26 68856]

"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2004-11-22 307200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]

"HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2005-09-21 1605740]

"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2005-11-12 180269]

"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-10-17 51048]

"osCheck"="c:\program files\Norton Internet Security\osCheck.exe" [2008-02-06 718704]

"MFP1815_S2P"="c:\program files\DELL\DELL LASER MFP 1815\PSU\Scan2Pc.exe" [2006-04-12 258048]

"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 155648]

"PaperPort PTD"="c:\program files\DELL\Dell Laser MFP 1815\PaperPort\pptd40nt.exe" [2006-02-20 36864]

"IndexSearch"="c:\program files\DELL\Dell Laser MFP 1815\PaperPort\IndexSearch.exe" [2006-02-20 40960]

"PPort10reminder"="c:\program files\DELL\Dell Laser MFP 1815\PaperPort\Ereg\Ereg.exe" [2005-06-03 729088]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-01-06 290088]

"AlwaysReady Power Message APP"="ARPWRMSG.EXE" [2005-08-03 c:\windows\arpwrmsg.exe]

"Logitech Utility"="Logi_MwX.Exe" [2003-12-17 c:\windows\LOGI_MWX.EXE]

c:\documents and settings\HP_Administrator\Start Menu\Programs\Startup\

BounceBack Launcher.lnk - c:\program files\CMS Products\BounceBack Express\BBLauncher.exe [2008-12-15 93888]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Timex Trainer Launcher.lnk - c:\program files\Timex\Timex Trainer\TBEggLaunch.exe [2007-02-27 61440]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"vidc.3IV2"= 3ivxVfWCodec.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Updates from HP.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Updates from HP.lnk

backup=c:\windows\pss\Updates from HP.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Updates from HP\\9972322\\Program\\Updates from HP.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=

"c:\\Program Files\\Sony\\Media Manager for PSP 2.0\\MediaManager.exe"=

"c:\\Program Files\\AIM6\\aim6.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=

R2 FlipShare Service;FlipShare Service;c:\program files\Pure Digital Technologies\FlipShare\FlipShareService.exe [2008-11-13 439616]

R2 IntuitUpdateService;Intuit Update Service;c:\program files\Common Files\Intuit\Update Service\IntuitUpdateService.exe [2008-10-10 13088]

R2 ioloFileInfoList;iolo FileInfoList Service;c:\program files\iolo\Common\Lib\ioloServiceManager.exe [2008-03-02 712048]

R2 ioloSystemService;iolo System Service;c:\program files\iolo\Common\Lib\ioloServiceManager.exe [2008-03-02 712048]

R2 LiveUpdate Notice;LiveUpdate Notice;c:\program files\Common Files\Symantec Shared\CCSVCHST.EXE [2008-01-25 149352]

R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2007-10-24 24652]

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2009-02-25 101936]

S1 ShldDrv;Panda File Shield Driver;c:\windows\system32\DRIVERS\ShlDrv51.sys --> c:\windows\system32\DRIVERS\ShlDrv51.sys [?]

S2 PavProc;Panda Process Protection Driver;\??\c:\windows\system32\DRIVERS\PavProc.sys --> c:\windows\system32\DRIVERS\PavProc.sys [?]

S3 COH_Mon;COH_Mon;c:\windows\system32\drivers\COH_Mon.sys [2008-01-12 23888]

S3 Wdm1;USB Bridge Cable Driver;c:\windows\system32\drivers\usbbc.sys [2005-03-18 15576]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - COMHOST

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]

\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe protect.ed 480 480

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{01c592bf-d281-11dd-bc9c-0015f24d51a8}]

\Shell\AutoRun\command - L:\Setup_FlipShare.exe

\Shell\Setup FlipShare\command - L:\Setup_FlipShare.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5fbfcabc-f787-11dd-bcc9-0015f24d51a8}]

\Shell\AutoRun\command - K:\DTSP_Launcher.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6dedde7c-b0ff-11dd-bc84-0015f24d51a8}]

\Shell\AutoRun\command - K:\DTSP_Launcher.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b2dde2b0-0ec8-11dc-ba6d-0015f24d51a8}]

\Shell\AutoRun\command - L:\DTSP_Launcher.exe

.

Contents of the 'Scheduled Tasks' folder

2009-02-21 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2009-03-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1016171264-2932520882-1517472993-1009.job

- c:\documents and settings\Grant & Griffin\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-02-17 17:35]

2009-02-10 c:\windows\Tasks\Norton Internet Security - Run Full System Scan - HP_Administrator.job

- c:\program files\Norton Internet Security\Norton AntiVirus\Navw32.exe [2008-02-07 05:05]

2009-03-02 c:\windows\Tasks\Symantec NetDetect.job

- c:\program files\Symantec\LiveUpdate\NDetect.exe []

.

- - - - ORPHANS REMOVED - - - -

HKCU-Run-Aim6 - (no file)

HKLM-Run-PCDrProfiler - (no file)

.

------- Supplementary Scan -------

.

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uStart Page = hxxp://www.google.com/

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

.

------- File Associations -------

.

JSEFile=NOTEPAD.EXE %1

VBEFile=NOTEPAD.EXE %1

VBSFile=NOTEPAD.EXE %1

.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-03-02 15:31:16

Windows 5.1.2600 Service Pack 3 NTFS

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 3:39:17 PM, on 3/2/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16791)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

C:\WINDOWS\system32\brss01a.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\WINDOWS\arservice.exe

C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe

C:\WINDOWS\eHome\ehRecvr.exe

C:\WINDOWS\eHome\ehSched.exe

C:\Program Files\Pure Digital Technologies\FlipShare\FlipShareService.exe

C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe

C:\Program Files\iolo\common\lib\ioloServiceManager.exe

C:\Program Files\Common Files\LightScribe\LSSrvc.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Viewpoint\Common\ViewpointService.exe

C:\WINDOWS\system32\dllhost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\ehome\ehtray.exe

C:\WINDOWS\ARPWRMSG.EXE

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\WINDOWS\eHome\ehmsas.exe

C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

C:\PROGRAM FILES\DELL\DELL LASER MFP 1815\PSU\Scan2Pc.exe

C:\Program Files\Logitech\MouseWare\system\em_exec.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\iolo\System Mechanic\SMTrayNotify.exe

C:\Program Files\Timex\Timex Trainer\TBEggLaunch.exe

C:\Program Files\CMS Products\BounceBack Express\BBLauncher.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\HP\KBD\KBD.EXE

C:\WINDOWS\ALCXMNTR.EXE

C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\notepad.exe

c:\windows\system\hpsysdrv.exe

C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe

C:\Program Files\Java\jre1.5.0_05\bin\jucheck.exe

C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe

C:\Program Files\internet explorer\iexplore.exe