MrCharlie Posted April 30, 2013 ID:675114 Share Posted April 30, 2013 Will work on it in the am, MrC Link to post Share on other sites More sharing options...
MrCharlie Posted April 30, 2013 ID:675199 Share Posted April 30, 2013 For your slow computer, make sure your hard drive is running in DMA mode:http://www.cdrlabs.c...ures-t7625.htmlhttp://forums.vso-so...s-xp-t2796.htmlSome tips on slow computer:http://users.telenet...owcomputer.htmlhttp://www.malwarere...nningslowly.phpYou can run StartUpLite to remove unnecessary items running at startup:http://www.malwareby...ts/startuplite/------------------------Do we still need to go back and do something about the line items that were uncovered by Rogue Killer? I don't believe we ever deleted or removed anything that was listed in the report.Yes, back up the registry first:http://www.geekstogo...ry-using-erunt/Then......Run RogueKiller again and click ScanWhen the scan completes > click on the Registry tabPut a check next to all of these and uncheck the rest: (if found)[sHELL][HJNAME] HKCU\[...]\Winlogon : Userinit (C:\Windows\system32\userinit.exe) [x] -> FOUND[sHELL][HJNAME] HKUS\S-1-5-21-57989841-1078081533-682003330-1003[...]\Winlogon : Userinit (C:\Windows\system32\userinit.exe) [x] -> FOUND[sHELL][HJNAME] HKUS\S-1-5-21-57989841-1078081533-682003330-1004[...]\Winlogon : Userinit (C:\Windows\system32\userinit.exe) [x] -> FOUND[sHELL][HJNAME] HKUS\S-1-5-21-57989841-1078081533-682003330-1005[...]\Winlogon : Userinit (C:\Windows\system32\userinit.exe) [x] -> FOUND[sHELL][HJNAME] HKUS\S-1-5-21-57989841-1078081533-682003330-1007[...]\Winlogon : Userinit (C:\Windows\system32\userinit.exe) [x] -> FOUND[sHELL][HJNAME] HKUS\S-1-5-21-57989841-1078081533-682003330-1009[...]\Winlogon : Userinit (C:\Windows\system32\userinit.exe) [x] -> FOUNDNow click Delete on the right hand column under Options--------------------------------Also, do we need to re-enable CD emulation that we previously disabled with defogger?When we're done you can.MrC Link to post Share on other sites More sharing options...
oasis Posted May 1, 2013 Author ID:675420 Share Posted May 1, 2013 Thanks MrC.Drives are already running in DMA mode.I removed a few items with StartupLite.I ran Rogue Killer again and deleted the six items you specified above. There is still one remaining item in the Registry tab that shows up in red font. I posted the latest RK log below.I have not yet re-enabled CD emulation.System is still slower than it used to be (especially on boot-up), but has definitely improved.On a boot, I still get a pop-up balloon from the sys tray with the message "Your computer might be at risk. Windows firewall is turned off." After about a minute, it goes away and Windows firewall appears to turn itself on.Would it also be smart to check for adware as a possible contributor to the system slowness? If so, what do you recommend to scan for it?Any other recommendations?RogueKiller V8.5.4 [Mar 18 2013] by Tigzymail : tigzyRK<at>gmail<dot>comFeedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/Website : http://tigzy.geekstogo.com/roguekiller.phpBlog : http://tigzyrk.blogspot.com/Operating System : Windows XP (5.1.2600 Service Pack 3) 32 bits versionStarted in : Normal modeUser : Bob [Admin rights]Mode : Scan -- Date : 04/30/2013 21:11:44| ARK || FAK || MBR |¤¤¤ Bad processes : 0 ¤¤¤¤¤¤ Registry Entries : 1 ¤¤¤[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND¤¤¤ Particular Files / Folders: ¤¤¤¤¤¤ Driver : [LOADED] ¤¤¤SSDT[12] : NtAlertResumeThread @ 0x805D4BDC -> HOOKED (Unknown @ 0x8B0557E0)SSDT[13] : NtAlertThread @ 0x805D4B8C -> HOOKED (Unknown @ 0x8B0559F0)SSDT[17] : NtAllocateVirtualMemory @ 0x805A8AC2 -> HOOKED (Unknown @ 0x8AF72500)SSDT[19] : NtAssignProcessToJobObject @ 0x805D66A0 -> HOOKED (Unknown @ 0x8B054C60)SSDT[31] : NtConnectPort @ 0x805A45D8 -> HOOKED (Unknown @ 0x8AED5650)SSDT[43] : NtCreateMutant @ 0x806177F2 -> HOOKED (Unknown @ 0x8B055440)SSDT[52] : NtCreateSymbolicLinkObject @ 0x805C3A02 -> HOOKED (Unknown @ 0x8B054970)SSDT[53] : NtCreateThread @ 0x805D1038 -> HOOKED (Unknown @ 0x8AF5B658)SSDT[57] : NtDebugActiveProcess @ 0x80643C82 -> HOOKED (Unknown @ 0x8B054D40)SSDT[68] : NtDuplicateObject @ 0x805BE010 -> HOOKED (Unknown @ 0x8B09C008)SSDT[83] : NtFreeVirtualMemory @ 0x805B2FBA -> HOOKED (Unknown @ 0x8B029B68)SSDT[89] : NtImpersonateAnonymousToken @ 0x805F9332 -> HOOKED (Unknown @ 0x8B055530)SSDT[91] : NtImpersonateThread @ 0x805D7860 -> HOOKED (Unknown @ 0x8B055720)SSDT[97] : NtLoadDriver @ 0x80584172 -> HOOKED (Unknown @ 0x8B0106D0)SSDT[108] : unknown @ 0x805B2042 -> HOOKED (Unknown @ 0x8B020A48)SSDT[114] : NtOpenEvent @ 0x8060F1B0 -> HOOKED (Unknown @ 0x8B055258)SSDT[122] : NtOpenProcess @ 0x805CB456 -> HOOKED (Unknown @ 0x8AD425B8)SSDT[123] : NtOpenProcessToken @ 0x805EE000 -> HOOKED (Unknown @ 0x8AD06720)SSDT[125] : NtOpenSection @ 0x805AA3F4 -> HOOKED (Unknown @ 0x8B054EF0)SSDT[128] : NtOpenThread @ 0x805CB6E2 -> HOOKED (Unknown @ 0x8ACF13D0)SSDT[137] : NtProtectVirtualMemory @ 0x805B8426 -> HOOKED (Unknown @ 0x8B054A60)SSDT[206] : NtResumeThread @ 0x805D4A18 -> HOOKED (Unknown @ 0x8B055AB0)SSDT[213] : NtSetContextThread @ 0x805D2C1A -> HOOKED (Unknown @ 0x8B053A70)SSDT[228] : NtSetInformationProcess @ 0x805CDEA0 -> HOOKED (Unknown @ 0x8B054210)SSDT[240] : NtSetSystemInformation @ 0x8060FE68 -> HOOKED (Unknown @ 0x8B054778)SSDT[253] : NtSuspendProcess @ 0x805D4AE0 -> HOOKED (Unknown @ 0x8B054FD0)SSDT[254] : NtSuspendThread @ 0x805D4952 -> HOOKED (Unknown @ 0x8B053CB8)SSDT[257] : NtTerminateProcess @ 0x805D22D8 -> HOOKED (Unknown @ 0x8AD26A18)SSDT[258] : unknown @ 0x805D24D2 -> HOOKED (Unknown @ 0x8B053990)SSDT[267] : NtUnmapViewOfSection @ 0x805B2E50 -> HOOKED (Unknown @ 0x8B054300)SSDT[277] : NtWriteVirtualMemory @ 0x805B43D4 -> HOOKED (Unknown @ 0x8B029C38)S_SSDT[307] : NtUserAttachThreadInput -> HOOKED (Unknown @ 0x8A0D9408)S_SSDT[383] : NtUserGetAsyncKeyState -> HOOKED (Unknown @ 0x8AF01410)S_SSDT[414] : NtUserGetKeyboardState -> HOOKED (Unknown @ 0x8AF8D2A8)S_SSDT[416] : NtUserGetKeyState -> HOOKED (Unknown @ 0x8AF018D0)S_SSDT[428] : NtUserGetRawInputData -> HOOKED (Unknown @ 0x8AF01950)S_SSDT[460] : NtUserMessageCall -> HOOKED (Unknown @ 0x8AEFA1D8)S_SSDT[475] : NtUserPostMessage -> HOOKED (Unknown @ 0x8AED21F8)S_SSDT[476] : NtUserPostThreadMessage -> HOOKED (Unknown @ 0x89FEF7B8)S_SSDT[549] : NtUserSetWindowsHookEx -> HOOKED (Unknown @ 0x89FEE840)S_SSDT[552] : NtUserSetWinEventHook -> HOOKED (Unknown @ 0x8B1B90D0)¤¤¤ HOSTS File: ¤¤¤--> J:\WINDOWS\system32\drivers\etc\hosts127.0.0.1 localhost192.168.1.2 HP000E7FD4E88F127.0.0.1 www.007guard.com127.0.0.1 007guard.com127.0.0.1 008i.com127.0.0.1 www.008k.com127.0.0.1 008k.com127.0.0.1 www.00hq.com127.0.0.1 00hq.com127.0.0.1 010402.com127.0.0.1 www.032439.com127.0.0.1 032439.com127.0.0.1 www.0scan.com127.0.0.1 0scan.com127.0.0.1 1000gratisproben.com127.0.0.1 www.1000gratisproben.com127.0.0.1 1001namen.com127.0.0.1 www.1001namen.com127.0.0.1 100888290cs.com[...]¤¤¤ MBR Check: ¤¤¤+++++ PhysicalDrive0: WDC WD1001FALS-00Y6A0 +++++--- User ---[MBR] 29c4c383c3910d3cbd7352336f01741e[bSP] e5689fa077fdbde540f3aa45688e8d30 : Windows XP MBR CodePartition table:0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 953859 MoUser = LL1 ... OK!User = LL2 ... OK!+++++ PhysicalDrive1: ST31000333AS +++++--- User ---[MBR] d8bc69b26b2ea6cd42733af77250683d[bSP] 588c4ef17834bb2909ed18f3951fe7ba : Empty MBR CodePartition table:0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 953867 MoUser = LL1 ... OK!User = LL2 ... OK!Finished : << RKreport[6]_S_04302013_02d2111.txt >>RKreport[1]_S_04282013_02d2227.txt ; RKreport[2]_S_04292013_02d1116.txt ; RKreport[3]_S_04292013_02d1140.txt ; RKreport[4]_S_04302013_02d2106.txt ; RKreport[5]_D_04302013_02d2109.txt ;RKreport[6]_S_04302013_02d2111.txt Link to post Share on other sites More sharing options...
MrCharlie Posted May 1, 2013 ID:675427 Share Posted May 1, 2013 Are you talking about this entry:[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUNDI'm not sure what it's for, it's in just about everyones log.....you can fix it if you want.---------------------------------------For the firewall, you can run Windows Repair again and just check this box:Repair Windows Firewall:Run it like you did before.--------------------------------------Please download AdwCleaner from here and save it on your Desktop.AdwCleaner is a reliable removal tool for Adware, Foistware, toolbars and potentially unwanted programs.AdwCleaner is a tool that deletes :· Adwares (software ads)· PUP/LPI (Potentially Undesirable Program)· Toolbars· Hijacker (Hijack of the browser's homepage)It works with a Search and Deletion methode. It can be easily uninstalled using the "Uninstall" mode. Right-click on adwcleaner.exe and select Run As Administrator (for XP just double click) to launch the application.Now click on the Search tab.Please post the contents of the log-file created in your next post.Note: The log can also be located at C:\ >> AdwCleaner[XX].txt >> XX <-- Denotes the number of times the application has been ran, so in this should be something like R1.Note:Please look over what was found......especially any folders, we're going to permanently delete it all in the next step....if there's something you may want to keep...please let me know and I'll explain to why it shouldn't be on your system.If you see AVG Secure Search being targeted for deletion, Here's Why and Here. You can always Reinstall it.Please note that Antivir Webguard uses ASK Toolbar as part of its web security. If you remove ASK by using Adwcleaner, Antivir Webguard will no longer work properly. Therefore, if you use this program please use the instructions below to access the options screen where you should enable /DisableAskDetections before using AdwCleaner.You can click on the question mark (?) in the upper left corner of the program and then click on Options. You will then be presented with a dialog where you can disable various detections. These options are described below:/DisableAskDetection - This option disables Ask Toolbar detection.MrC Link to post Share on other sites More sharing options...
oasis Posted May 1, 2013 Author ID:675462 Share Posted May 1, 2013 Ran windows repair again with repair windows firewall checked. Rebooted. No change. The firewall off message still appears for 1-2 minutes after boot.Ran Adwcleaner search. Nothing in the results that I recognize or want to keep. Here is the log...# AdwCleaner v2.300 - Logfile created 04/30/2013 at 23:50:51# Updated 28/04/2013 by Xplode# Operating system : Microsoft Windows XP Service Pack 3 (32 bits)# User : Bob - OFFICE-SERVER# Boot Mode : Normal# Running from : J:\Documents and Settings\Bob\Desktop\adwcleaner.exe# Option [search]***** [services] ********** [Files / Folders] *****Folder Found : J:\Documents and Settings\Bob\My Documents\Video Downloader***** [Registry] *****Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\grusskartencenter.comKey Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\grusskartencenter.comKey Found : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\063A857434EDED11A893800002C0A966Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0FF2AEFF45EEA0A48A4B33C1973B6094Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536Key Found : HKU\S-1-5-21-57989841-1078081533-682003330-1003\Software\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}Key Found : HKU\S-1-5-21-57989841-1078081533-682003330-1004\Software\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}***** [internet Browsers] *****-\\ Internet Explorer v8.0.6001.18702[OK] Registry is clean.*************************AdwCleaner[R1].txt - [1729 octets] - [30/04/2013 23:50:51]########## EOF - J:\AdwCleaner[R1].txt - [1789 octets] ########## Link to post Share on other sites More sharing options...
MrCharlie Posted May 1, 2013 ID:675507 Share Posted May 1, 2013 Go to Start > Run > services.msc > OKWindows Firewall > make sure it's set to Automatic-----------------------------------Some adware found....lets clear it out.....Please re-run AdwCleanerClick on Delete button.Confirm each time with OK if asked.Your computer will be rebooted automatically. A text file will open after the restart. Please post the content of that logfile in your reply.Note: You can find the logfile at C:\AdwCleaner[sn].txt as well - n is the order number.Then......Lets check your computers security before you go and we have a little cleanup to do also:Download Security Check by screen317 from HERE or HERE.Save it to your Desktop.Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.A Notepad document should open automatically called checkup.txt.Please Post the contents of that document.Do Not Attach It!!!MrC Link to post Share on other sites More sharing options...
oasis Posted May 2, 2013 Author ID:675669 Share Posted May 2, 2013 Windows firewall already set to automatic.Cleared Adware. Log file below.Ran Security Check. Log file below.Thanks.# AdwCleaner v2.300 - Logfile created 05/01/2013 at 12:26:26# Updated 28/04/2013 by Xplode# Operating system : Microsoft Windows XP Service Pack 3 (32 bits)# User : Bob - OFFICE-SERVER# Boot Mode : Normal# Running from : J:\Documents and Settings\Bob\Desktop\adwcleaner.exe# Option [Delete]***** [services] ********** [Files / Folders] *****Folder Deleted : J:\Documents and Settings\Bob\My Documents\Video Downloader***** [Registry] *****Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\grusskartencenter.comKey Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\grusskartencenter.comKey Deleted : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\063A857434EDED11A893800002C0A966Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0FF2AEFF45EEA0A48A4B33C1973B6094Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536Key Deleted : HKU\S-1-5-21-57989841-1078081533-682003330-1004\Software\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}***** [internet Browsers] *****-\\ Internet Explorer v8.0.6001.18702[OK] Registry is clean.*************************AdwCleaner[R1].txt - [1858 octets] - [30/04/2013 23:50:51]AdwCleaner[s1].txt - [1657 octets] - [01/05/2013 12:26:26]########## EOF - J:\AdwCleaner[s1].txt - [1717 octets] ########## Results of screen317's Security Check version 0.99.63 Windows XP Service Pack 3 x86 (UAC is enabled) Internet Explorer 8 ``````````````Antivirus/Firewall Check:`````````````` Windows Firewall Enabled! Lavasoft Ad-Watch Live! Anti-Virus Antivirus up to date! `````````Anti-malware/Other Utilities Check:````````` Ad-Aware MVPS Hosts File Spybot - Search & Destroy Norton Ghost Malwarebytes Anti-Malware version 1.75.0.1300 Adobe Flash Player 11.2.202.235 Adobe Reader 10.1.6 Adobe Reader out of Date! ````````Process Check: objlist.exe by Laurent```````` Norton ccSvcHst.exe Ad-Aware AAWService.exe Ad-Aware AAWTray.exe`````````````````System Health check````````````````` Total Fragmentation on Drive J:: 9%````````````````````End of Log`````````````````````` Link to post Share on other sites More sharing options...
MrCharlie Posted May 2, 2013 ID:675703 Share Posted May 2, 2013 This has been suggested as a fix:Try resetting the Windows Security Center.1. Click on Start > Run > type services.msc2. Locate and stop Windows Management Instrumentation & Security Center. By default, the Startup Type on both should be Automatic.3. Go to C:\WINDOWS\system32\wbem.4. Only delete the Repository folder.5. Reboot your computer.This will rebuild the deleted folder and the database.--------------------------------------------Out dated programs on the system are vulnerable to malware.Please update or uninstall them:Adobe Reader 10.1.6 Adobe Reader out of Date! <---please check for an update if available or uninstall and download and install Foxit Reader which is less vulnerable to malware and much better than Adobe. Don't install any toolbars that may come with it (ASK Toolbar).Let me know.....MrC Link to post Share on other sites More sharing options...
oasis Posted May 3, 2013 Author ID:675852 Share Posted May 3, 2013 I uninstalled Adobe Reader and installed Foxit. Works fine.I followed the reset of Security Center instructions but it did not fix the delayed firewall problem.I also uninstalled Lavasoft Adaware, which actually appeared to have two separate installations on my PC. Now I also get a message in the Windows notifier pop-up that says "Lavasoft Ad-watch Live Anti-virus reports that it is turned off".Windows security center apparently thinks that I do not have anti-virus running even though I have Norton 360 active and up-to-date.Not sure how I get that message to stop as I don't have any Lavasoft application installed any longer.I also have no idea why Windows Security Center won't recognize Norton 360.One other note: I seem to ocassionally get complete freeze-up of any open windows. I can still move the mouse but none of the open apps respond to click.If I hit CTRL-ALT-DEL, everything unfreezes as soon as the Windows Task Manager window pops up.Any ideas? Thanks again. Link to post Share on other sites More sharing options...
MrCharlie Posted May 3, 2013 ID:675888 Share Posted May 3, 2013 Please download and run ComboFix.The most important things to remember when running it is to disable all your malware programs and run Combofix from your desktop.Please visit this webpage for download links, and instructions for running ComboFixhttp://www.bleepingcomputer.com/combofix/how-to-use-combofixEnsure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.Information on disabling your malware programs can be found Here.Make sure you run ComboFix from your desktop. Give it at least 30-45 minutes to finish if needed.Please include the C:\ComboFix.txt in your next reply for further review.---------->NOTE<----------If you get the message Illegal operation attempted on registry key that has been marked for deletion after you run ComboFix....please reboot the computer, this should resolve the problem. You may have to do this several times if needed.MrC Link to post Share on other sites More sharing options...
oasis Posted May 3, 2013 Author ID:676006 Share Posted May 3, 2013 Unfortunately, I am unable to get combofix to run. I have tried it three different times and it always hangs on the autoscan screen. One of the times, I let it go for over three hours just to be sure. All antivirus and firewalls are disabled. Link to post Share on other sites More sharing options...
MrCharlie Posted May 3, 2013 ID:676007 Share Posted May 3, 2013 Try it in safe mode.....MrC Link to post Share on other sites More sharing options...
oasis Posted May 3, 2013 Author ID:676036 Share Posted May 3, 2013 Same result. Just hangs at the autoscan screen. Link to post Share on other sites More sharing options...
MrCharlie Posted May 3, 2013 ID:676037 Share Posted May 3, 2013 Try it like this......Delete your copy of ComboFix. Grab a fresh copy and save it to your Desktop, but do not run it yet.Please reboot to Safe Mode (tap the F8 key just before Windows starts to load and select the Safe Mode option from the menu).Click Start --> Run, and enter this command exactly as shown: (copy and paste)"%userprofile%\desktop\combofix.exe" /nombrSee if it will run successfully now. MrC Link to post Share on other sites More sharing options...
oasis Posted May 4, 2013 Author ID:676078 Share Posted May 4, 2013 That method worked and ComboFix ran successfully. Log file posted below.Can't tell yet if anything major changed as a result of ComboFix.My Windows firewall now appears to be on when the computer is booted, so I think it fixed that issue.I still get the warning about Lavasoft Ad-Watch Live Anti-virus being off.Still not sure why I get anything referencing Lavasoft when I completely uninstalled those applications.Windows Security Center seems to think I am without anti-virus protection even though I have Norton 360 running normally and up to date.ComboFix 13-05-01.03 - Bob 05/03/2013 22:21:31.1.4 - x86 MINIMALMicrosoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3323.2878 [GMT -4:00]Running from: j:\documents and settings\Bob\desktop\combofix.exeCommand switches used :: /nombrAV: Lavasoft Ad-Watch Live! Anti-Virus *Disabled/Updated* {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}..((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))..j:\documents and settings\All Users\Application Data\TEMPj:\documents and settings\Bob\g2mdlhlpx.exej:\windows\EventSystem.logj:\windows\system32\URTTempj:\windows\system32\URTTemp\regtlib.exe..((((((((((((((((((((((((( Files Created from 2013-04-04 to 2013-05-04 )))))))))))))))))))))))))))))))..2013-05-03 21:55 . 2013-05-03 21:56 -------- d-----w- j:\documents and settings\Administrator2013-05-03 03:03 . 2013-05-03 03:04 -------- d-----w- j:\documents and settings\Bob\Application Data\Foxit Software2013-05-03 03:03 . 2013-05-03 03:03 -------- d-----w- j:\program files\Foxit Software2013-05-03 02:37 . 2013-05-03 02:37 -------- d-----w- j:\windows\system32\wbem\Repository2013-05-02 18:30 . 2013-05-02 18:30 159744 ----a-w- j:\program files\Internet Explorer\Plugins\npqtplugin7.dll2013-05-02 18:30 . 2013-05-02 18:30 159744 ----a-w- j:\program files\Internet Explorer\Plugins\npqtplugin6.dll2013-05-02 18:30 . 2013-05-02 18:30 159744 ----a-w- j:\program files\Internet Explorer\Plugins\npqtplugin5.dll2013-05-02 18:30 . 2013-05-02 18:30 159744 ----a-w- j:\program files\Internet Explorer\Plugins\npqtplugin4.dll2013-05-02 18:30 . 2013-05-02 18:30 159744 ----a-w- j:\program files\Internet Explorer\Plugins\npqtplugin3.dll2013-05-02 18:30 . 2013-05-02 18:30 159744 ----a-w- j:\program files\Internet Explorer\Plugins\npqtplugin2.dll2013-05-02 18:30 . 2013-05-02 18:30 159744 ----a-w- j:\program files\Internet Explorer\Plugins\npqtplugin.dll2013-05-02 18:30 . 2013-05-02 18:30 -------- d-----w- j:\program files\QuickTime2013-05-01 01:04 . 2013-05-01 01:04 -------- d-----w- j:\program files\ERUNT2013-04-30 02:15 . 2013-04-30 02:15 -------- d-----w- j:\documents and settings\All Users\Application Data\McAfee2013-04-29 22:55 . 2013-04-29 22:55 -------- d-----w- j:\windows\system32\winrm2013-04-29 22:55 . 2013-04-29 22:55 -------- dc-h--w- j:\windows\$968930Uinstall_KB968930$2013-04-29 20:13 . 2013-05-04 02:20 -------- d-----w- j:\windows\system32\CatRoot22013-04-29 18:01 . 2013-05-01 03:41 181064 ----a-w- j:\windows\PSEXESVC.EXE2013-04-29 17:57 . 2013-04-29 17:57 -------- d-----w- J:\RegBackup2013-04-29 16:26 . 2013-04-29 16:26 -------- d-----w- j:\program files\Malwarebytes' Anti-Malware2013-04-29 16:26 . 2013-04-04 18:50 22856 ----a-w- j:\windows\system32\drivers\mbam.sys2013-04-29 05:47 . 2013-04-29 05:55 -------- d-----w- j:\windows\system32\drivers\N360\1403010.0162013-04-29 05:34 . 2013-04-29 05:34 -------- d-----w- j:\documents and settings\Bob\Application Data\Malwarebytes2013-04-29 02:20 . 2013-04-29 02:20 -------- d-----w- J:\_OTL2013-04-24 02:02 . 2013-04-24 02:02 -------- d---a-w- J:\$Anvi Rescue Disk$2013-04-23 19:54 . 2013-04-24 01:09 -------- d-----w- j:\windows\Microsoft Antimalware2013-04-23 08:39 . 2013-04-24 02:09 -------- d-----w- j:\documents and settings\Michael2013-04-23 07:57 . 2013-04-23 07:57 -------- d-----w- j:\documents and settings\Michelle\Application Data\Malwarebytes2013-04-23 07:56 . 2013-04-23 07:56 -------- d-----w- j:\documents and settings\All Users\Application Data\Malwarebytes2013-04-23 07:36 . 2013-04-23 07:45 -------- d-----w- j:\documents and settings\All Users\Application Data\2C533BF2BA1AC45700002C530FA4C9762013-04-10 21:04 . 2010-09-07 18:26 28160 ----a-w- j:\windows\system32\drivers\PcaSp50.sys2013-04-10 21:04 . 2006-11-29 01:46 41280 ----a-w- j:\windows\system32\drivers\PCASp50a64.sys2013-04-10 21:04 . 2003-04-22 01:46 61440 ----a-w- j:\windows\system32\ASIW32N50.dll2013-04-10 21:04 . 2002-09-10 23:35 16302 ----a-w- j:\windows\system32\ASINDIS5.sys2013-04-10 21:04 . 2001-04-16 09:48 15577 ----a-w- j:\windows\system32\ASINDIS3.vxd2013-04-10 21:04 . 2013-04-10 21:04 -------- d-----w- j:\program files\ASUS...(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))).2013-04-29 05:48 . 2011-04-16 03:50 142496 ----a-w- j:\windows\system32\drivers\SYMEVENT.SYS2013-03-23 05:22 . 2011-05-21 10:01 1869600 ----a-w- j:\windows\system32\nvcuvenc.dll2013-03-23 05:22 . 2008-07-27 05:18 7536640 ----a-w- j:\windows\system32\nvcuda.dll2013-03-23 05:22 . 2008-07-27 05:18 19189760 ----a-w- j:\windows\system32\nvoglnt.dll2013-03-23 05:22 . 2008-07-27 05:18 12653120 ----a-w- j:\windows\system32\drivers\nv4_mini.sys2013-03-23 05:22 . 2013-03-23 05:22 5967872 ----a-w- j:\windows\system32\nvopencl.dll2013-03-23 05:22 . 2013-03-23 05:22 1010464 ----a-w- j:\windows\system32\nvdispco3230790.dll2013-03-23 05:22 . 2011-05-21 10:01 17551360 ----a-w- j:\windows\system32\nvcompiler.dll2013-03-23 05:22 . 2008-07-27 05:18 4494720 ----a-w- j:\windows\system32\nv4_disp.dll2013-03-23 05:22 . 2013-03-23 05:22 893728 ----a-w- j:\windows\system32\nvdispgenco3230790.dll2013-03-23 05:22 . 2008-07-27 05:18 2392064 ----a-w- j:\windows\system32\nvapi.dll2013-03-23 05:22 . 2011-05-21 10:01 2582816 ----a-w- j:\windows\system32\nvcuvid.dll2013-03-21 22:30 . 2008-07-27 05:18 126976 ----a-w- j:\windows\system32\nvrszht.dll2013-03-21 22:30 . 2008-07-27 05:18 258048 ----a-w- j:\windows\system32\nvrstr.dll2013-03-21 22:30 . 2008-07-27 05:18 258048 ----a-w- j:\windows\system32\nvrssl.dll2013-03-21 22:30 . 2008-07-27 05:18 258048 ----a-w- j:\windows\system32\nvrssk.dll2013-03-21 22:30 . 2008-07-27 05:18 253952 ----a-w- j:\windows\system32\nvrsth.dll2013-03-21 22:30 . 2008-07-27 05:18 253952 ----a-w- j:\windows\system32\nvrssv.dll2013-03-21 22:30 . 2008-07-27 05:18 229376 ----a-w- j:\windows\system32\nvrszhc.dll2013-03-21 22:30 . 2008-07-27 05:18 274432 ----a-w- j:\windows\system32\nvrspt.dll2013-03-21 22:30 . 2008-07-27 05:18 270336 ----a-w- j:\windows\system32\nvrsru.dll2013-03-21 22:30 . 2008-07-27 05:18 270336 ----a-w- j:\windows\system32\nvrsptb.dll2013-03-21 22:30 . 2008-07-27 05:18 258048 ----a-w- j:\windows\system32\nvrspl.dll2013-03-21 22:30 . 2008-07-27 05:18 253952 ----a-w- j:\windows\system32\nvrsno.dll2013-03-21 22:30 . 2008-07-27 05:18 282624 ----a-w- j:\windows\system32\nvrsit.dll2013-03-21 22:30 . 2008-07-27 05:18 274432 ----a-w- j:\windows\system32\nvrsnl.dll2013-03-21 22:30 . 2008-07-27 05:18 274432 ----a-w- j:\windows\system32\nvrsja.dll2013-03-21 22:30 . 2008-07-27 05:18 266240 ----a-w- j:\windows\system32\nvrsko.dll2013-03-21 22:30 . 2008-07-27 05:18 335872 ----a-w- j:\windows\system32\nvrshe.dll2013-03-21 22:30 . 2008-07-27 05:18 286720 ----a-w- j:\windows\system32\nvrsfr.dll2013-03-21 22:30 . 2008-07-27 05:18 262144 ----a-w- j:\windows\system32\nvrshu.dll2013-03-21 22:30 . 2008-07-27 05:18 249856 ----a-w- j:\windows\system32\nvrsfi.dll2013-03-21 22:30 . 2008-07-27 05:18 282624 ----a-w- j:\windows\system32\nvrses.dll2013-03-21 22:30 . 2008-07-27 05:18 282624 ----a-w- j:\windows\system32\nvrsel.dll2013-03-21 22:30 . 2008-07-27 05:18 278528 ----a-w- j:\windows\system32\nvrsde.dll2013-03-21 22:30 . 2008-07-27 05:18 274432 ----a-w- j:\windows\system32\nvrsesm.dll2013-03-21 22:30 . 2008-07-27 05:18 249856 ----a-w- j:\windows\system32\nvrseng.dll2013-03-21 22:30 . 2008-07-27 05:18 335872 ----a-w- j:\windows\system32\nvrsar.dll2013-03-21 22:30 . 2008-07-27 05:18 253952 ----a-w- j:\windows\system32\nvrsda.dll2013-03-21 22:30 . 2008-07-27 05:18 249856 ----a-w- j:\windows\system32\nvrscs.dll2013-03-21 22:26 . 2008-07-27 05:18 54272 ----a-w- j:\windows\system32\nvwddi.dll2013-03-21 22:26 . 2008-07-27 05:18 156448 ----a-w- j:\windows\system32\nvsvc32.exe2013-03-21 22:26 . 2008-07-27 05:18 15517984 ----a-w- j:\windows\system32\nvcpl.dll2013-03-21 22:26 . 2008-07-27 05:18 108832 ----a-w- j:\windows\system32\nvmctray.dll2013-03-21 22:25 . 2008-07-27 05:18 144160 ----a-w- j:\windows\system32\nvcolor.exe2013-03-08 08:36 . 2008-04-14 12:00 293376 ----a-w- j:\windows\system32\winsrv.dll2013-03-07 01:32 . 2008-04-14 12:00 2149888 ----a-w- j:\windows\system32\ntoskrnl.exe2013-03-07 00:50 . 2008-04-14 00:01 2028544 ----a-w- j:\windows\system32\ntkrnlpa.exe2013-03-02 02:06 . 2008-04-14 12:00 916480 ----a-w- j:\windows\system32\wininet.dll2013-03-02 02:06 . 2008-04-14 12:00 43520 ----a-w- j:\windows\system32\licmgr10.dll2013-03-02 02:06 . 2008-04-14 12:00 1469440 ----a-w- j:\windows\system32\inetcpl.cpl2013-03-02 01:25 . 2008-04-14 12:00 1867264 ----a-w- j:\windows\system32\win32k.sys2013-03-02 01:08 . 2008-04-14 12:00 385024 ----a-w- j:\windows\system32\html.iec2013-02-27 07:56 . 2009-03-14 15:33 2067456 ----a-w- j:\windows\system32\mstscax.dll2013-02-12 00:32 . 2008-04-14 12:00 12928 ----a-w- j:\windows\system32\drivers\usb8023.sys..((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shownREGEDIT4.[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"NortonUtilities"="j:\program files\Norton Utilities 14\nu.exe" [2010-08-24 4093288]"SansaDispatch"="j:\documents and settings\Bob\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe" [2011-06-22 79872]"gStart"="j:\garmin\gStart.exe" [2008-08-13 1891416]"Akamai NetSession Interface"="j:\documents and settings\Bob\Local Settings\Application Data\Akamai\netsession_win.exe" [2013-01-26 4480768]"swg"="j:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-03-18 39408].[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"Symantec PIF AlertEng"="j:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 583048]"SSBkgdUpdate"="j:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 155648]"PaperPort PTD"="j:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2005-03-17 57393]"IndexSearch"="j:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2005-03-17 40960]"ControlCenter2.0"="j:\program files\Brother\ControlCenter2\brctrcen.exe" [2007-12-21 86016]"SysTrayApp"="j:\program files\IDT\WDM\sttray.exe" [2008-05-07 413696]"type32"="j:\program files\Microsoft IntelliType Pro\type32.exe" [2004-06-03 172032]"IntelliPoint"="j:\program files\Microsoft IntelliPoint\point32.exe" [2004-06-03 204800]"HPDJ Taskbar Utility"="j:\windows\system32\spool\drivers\w32x86\3\hpztsb11.exe" [2004-04-06 172032]"HPHUPD06"="j:\program files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe" [2004-06-07 49152]"HPHmon06"="j:\windows\system32\hphmon06.exe" [2004-06-07 659456]"Norton Ghost 14.0"="j:\program files\Norton Ghost\Agent\VProTray.exe" [2008-12-11 2245992]"Share-to-Web Namespace Daemon"="j:\program files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" [2001-07-03 57344]"nmctxth"="j:\program files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2008-12-12 642856]"Live! Central 2"="j:\program files\Creative\Creative Live! Cam\Live! Central 2\CTLVCentral2.exe" [2009-08-28 426140]"V0610Mon.exe"="j:\windows\V0610Mon.exe" [2009-08-06 24576]"Monitor"="j:\program files\LeapFrog\LeapFrog Connect\Monitor.exe" [2010-07-28 554328]"BCSSync"="j:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]"BrMfcWnd"="j:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2008-10-11 1085440]"ControlCenter3"="j:\program files\Brother\ControlCenter3\brctrcen.exe" [2007-12-21 86016]"iTunesHelper"="j:\program files\iTunes\iTunesHelper.exe" [2013-02-20 152392]"APSDaemon"="j:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-01-28 59720]"NvMediaCenter"="NvMCTray.dll" [2013-03-21 108832]"QuickTime Task"="j:\program files\QuickTime\qttask.exe" [2012-10-25 421888].j:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk - j:\program files\HP\digital imaging\bin\hpqtra08.exe [2004-5-28 241664]HP Image Zone Fast Start.lnk - j:\program files\HP\digital imaging\bin\hpqthb08.exe [2004-5-28 53248]NCProTray.lnk - j:\program files\SEC\Natural Color Pro\NCProTray.exe [2009-3-14 49220]Windows Search.lnk - j:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904].[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]"ConsentPromptBehaviorAdmin"= 5 (0x5)"EnableUIADesktopToggle"= 0 (0x0)"ConsentPromptBehaviorUser"= 3 (0x3).[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]"NoAdminPage"= 0 (0x0).[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]"NoChangeStartMenu"= 00000000"MaxRecentDocs"= 0 (0x0)"NoWinKey"= 0 (0x0)"NoNetConnextDisconnect"= 0 (0x0)"NoSMConfigurePrograms"= 0 (0x0)"NoControlPanle"= 0 (0x0).[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "j:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DiskeeperSystrayHKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component ManagerHKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software UpdateHKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheckHKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemonHKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwizHKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime TaskHKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg.[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]"DisableMonitoring"=dword:00000001.[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]"DisableMonitoring"=dword:00000001.[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]"DisableMonitoring"=dword:00000001.[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]"%windir%\\system32\\sessmgr.exe"="j:\\Documents and Settings\\Bob\\Local Settings\\Application Data\\Akamai\\netsession_win.exe"="j:\\Program Files\\NVIDIA Corporation\\NVIDIA Update Core\\daemonu.exe"=.[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]"5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management"1131:TCP"= 1131:TCP:Akamai NetSession Interface"5000:UDP"= 5000:UDP:Akamai NetSession Interface.R0 SymDS;Symantec Data Store;j:\windows\system32\drivers\N360\1403010.016\symds.sys [4/29/2013 1:47 AM 367704]R0 SymEFA;Symantec Extended File Attributes;j:\windows\system32\drivers\N360\1403010.016\symefa.sys [4/29/2013 1:47 AM 934488]S0 Lbd;Lbd;j:\windows\system32\DRIVERS\Lbd.sys --> j:\windows\system32\DRIVERS\Lbd.sys [?]S1 BHDrvx86;BHDrvx86;j:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\BASHDefs\20130412.001\BHDrvx86.sys [4/12/2013 7:53 PM 1000024]S1 ccSet_N360;Norton 360 Settings Manager;j:\windows\system32\drivers\N360\1403010.016\ccsetx86.sys [4/29/2013 1:47 AM 134304]S1 SymIRON;Symantec Iron Driver;j:\windows\system32\drivers\N360\1403010.016\ironx86.sys [4/29/2013 1:47 AM 175264]S2 gupdate1c9a76164ab2998;Google Update Service (gupdate1c9a76164ab2998);j:\program files\Google\Update\GoogleUpdate.exe [3/17/2009 8:35 PM 133104]S2 IntuitUpdateServiceV4;Intuit Update Service v4;j:\program files\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe [8/23/2012 12:37 PM 13672]S2 LinksysUpdater;Linksys Updater;j:\program files\Linksys\Linksys Updater\bin\LinksysUpdater.exe [11/13/2008 3:43 PM 204800]S2 N360;Norton 360;j:\program files\Norton 360\Engine\20.3.1.22\ccsvchst.exe [4/29/2013 1:47 AM 144520]S2 SkypeUpdate;Skype Updater;j:\program files\Skype\Updater\Updater.exe [7/13/2012 2:28 PM 160944]S2 Symantec SymSnap VSS Provider;Symantec SymSnap VSS Provider;j:\windows\system32\dllhost.exe [4/14/2008 8:00 AM 5120]S3 CtClsFlt;Creative Camera Class Upper Filter Driver;j:\windows\system32\drivers\CtClsFlt.sys [8/8/2010 7:56 PM 143936]S3 DCamUSBIntel;USB Video Camera for Intel Proshare technology;j:\windows\system32\drivers\usbintel.sys [4/13/2008 8:15 PM 15872]S3 EraserUtilRebootDrv;EraserUtilRebootDrv;j:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [4/21/2013 8:42 PM 106656]S3 IDSxpx86;IDSxpx86;j:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\IPSDefs\20130503.001\IDSXpx86.sys [5/3/2013 9:31 PM 373728]S3 nosGetPlusHelper;getPlus® Helper 3004;j:\windows\System32\svchost.exe -k nosGetPlusHelper [4/14/2008 8:00 AM 14336]S3 SymSnapService;SymSnapService;j:\program files\Norton Ghost\Shared\Drivers\SymSnapService.exe [12/20/2007 5:13 PM 1558000]S3 V0610Afx;Creative Camera VF0610 Audio Effects Driver;j:\windows\system32\drivers\V0610Afx.sys [8/8/2010 7:59 PM 160256]S3 V0610Vid;Creative Live! Cam Socialize HD Driver;j:\windows\system32\drivers\V0610Vid.sys [8/8/2010 7:58 PM 274624].[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]nosGetPlusHelper REG_MULTI_SZ nosGetPlusHelper.Contents of the 'Scheduled Tasks' folder.2013-05-02 j:\windows\Tasks\AppleSoftwareUpdate.job- j:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 21:57].2013-05-03 j:\windows\Tasks\Google Software Updater.job- j:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-03-18 15:51].2013-05-04 j:\windows\Tasks\GoogleUpdateTaskMachineCore.job- j:\program files\Google\Update\GoogleUpdate.exe [2009-03-18 00:35].2013-05-04 j:\windows\Tasks\GoogleUpdateTaskMachineUA.job- j:\program files\Google\Update\GoogleUpdate.exe [2009-03-18 00:35]..------- Supplementary Scan -------.uStart Page = hxxp://www.google.com/uInternet Settings,ProxyOverride = *.local;<local>uSearchAssistant = hxxp://www.google.com/ieuSearchURL,(Default) = hxxp://www.google.com/search?q=%sTCP: DhcpNameServer = 192.168.1.1DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} - hxxp://77.105.97.97:8000/activex/AMC.cab.- - - - ORPHANS REMOVED - - - -.Toolbar-Locked - (no file)MSConfigStartUp-CTFMON - (no file)...**************************************************************************.catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.netRootkit scan 2013-05-03 22:27Windows 5.1.2600 Service Pack 3 NTFS.scanning hidden processes ... .scanning hidden autostart entries ....HKCU\Software\Microsoft\Windows\CurrentVersion\Run SansaDispatch = j:\documents and settings\Bob\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe??1?"?>? ? ?<?h?e?a?d?>? ? ?<?t?i?t?l?e?>?I?F?r?a?m?e? ?G?e?n?e?r?i?c? ?M?e?s?s?a?g?e?<.scanning hidden files ... .scan completed successfullyhidden files: 0.**************************************************************************.[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\N360]"ImagePath"="\"j:\program files\Norton 360\Engine\20.3.1.22\ccSvcHst.exe\" /s \"N360\" /m \"j:\program files\Norton 360\Engine\20.3.1.22\diMaster.dll\" /prefetch:1".--------------------- LOCKED REGISTRY KEYS ---------------------.[HKEY_USERS\S-1-5-21-57989841-1078081533-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*# #´]@Class="Shell".[HKEY_LOCAL_MACHINE\software\Classes\.xml\PersistentHandler]@DACL=(02 0000)@="{7E9D8D44-6926-426F-AA2B-217A819A5CCE}".[HKEY_LOCAL_MACHINE\software\Classes\.xsl\PersistentHandler]@DACL=(02 0000)@="{7E9D8D44-6926-426F-AA2B-217A819A5CCE}".Completion time: 2013-05-03 22:29:53ComboFix-quarantined-files.txt 2013-05-04 02:29.Pre-Run: 937,039,290,368 bytes freePost-Run: 937,419,485,184 bytes free.- - End Of File - - 51E39FED1AC76AF7933B93AD9F9EAB5C Link to post Share on other sites More sharing options...
oasis Posted May 4, 2013 Author ID:676079 Share Posted May 4, 2013 That method worked and ComboFix ran successfully. Log file posted below.Can't tell yet if anything major changed as a result of ComboFix.My Windows firewall now appears to be on when the computer is booted, so I think it fixed that issue.I still get the warning about Lavasoft Ad-Watch Live Anti-virus being off.Still not sure why I get anything referencing Lavasoft when I completely uninstalled those applications.Windows Security Center seems to think I am without anti-virus protection even though I have Norton 360 running normally and up to date.ComboFix 13-05-01.03 - Bob 05/03/2013 22:21:31.1.4 - x86 MINIMALMicrosoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3323.2878 [GMT -4:00]Running from: j:\documents and settings\Bob\desktop\combofix.exeCommand switches used :: /nombrAV: Lavasoft Ad-Watch Live! Anti-Virus *Disabled/Updated* {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}..((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))..j:\documents and settings\All Users\Application Data\TEMPj:\documents and settings\Bob\g2mdlhlpx.exej:\windows\EventSystem.logj:\windows\system32\URTTempj:\windows\system32\URTTemp\regtlib.exe..((((((((((((((((((((((((( Files Created from 2013-04-04 to 2013-05-04 )))))))))))))))))))))))))))))))..2013-05-03 21:55 . 2013-05-03 21:56 -------- d-----w- j:\documents and settings\Administrator2013-05-03 03:03 . 2013-05-03 03:04 -------- d-----w- j:\documents and settings\Bob\Application Data\Foxit Software2013-05-03 03:03 . 2013-05-03 03:03 -------- d-----w- j:\program files\Foxit Software2013-05-03 02:37 . 2013-05-03 02:37 -------- d-----w- j:\windows\system32\wbem\Repository2013-05-02 18:30 . 2013-05-02 18:30 159744 ----a-w- j:\program files\Internet Explorer\Plugins\npqtplugin7.dll2013-05-02 18:30 . 2013-05-02 18:30 159744 ----a-w- j:\program files\Internet Explorer\Plugins\npqtplugin6.dll2013-05-02 18:30 . 2013-05-02 18:30 159744 ----a-w- j:\program files\Internet Explorer\Plugins\npqtplugin5.dll2013-05-02 18:30 . 2013-05-02 18:30 159744 ----a-w- j:\program files\Internet Explorer\Plugins\npqtplugin4.dll2013-05-02 18:30 . 2013-05-02 18:30 159744 ----a-w- j:\program files\Internet Explorer\Plugins\npqtplugin3.dll2013-05-02 18:30 . 2013-05-02 18:30 159744 ----a-w- j:\program files\Internet Explorer\Plugins\npqtplugin2.dll2013-05-02 18:30 . 2013-05-02 18:30 159744 ----a-w- j:\program files\Internet Explorer\Plugins\npqtplugin.dll2013-05-02 18:30 . 2013-05-02 18:30 -------- d-----w- j:\program files\QuickTime2013-05-01 01:04 . 2013-05-01 01:04 -------- d-----w- j:\program files\ERUNT2013-04-30 02:15 . 2013-04-30 02:15 -------- d-----w- j:\documents and settings\All Users\Application Data\McAfee2013-04-29 22:55 . 2013-04-29 22:55 -------- d-----w- j:\windows\system32\winrm2013-04-29 22:55 . 2013-04-29 22:55 -------- dc-h--w- j:\windows\$968930Uinstall_KB968930$2013-04-29 20:13 . 2013-05-04 02:20 -------- d-----w- j:\windows\system32\CatRoot22013-04-29 18:01 . 2013-05-01 03:41 181064 ----a-w- j:\windows\PSEXESVC.EXE2013-04-29 17:57 . 2013-04-29 17:57 -------- d-----w- J:\RegBackup2013-04-29 16:26 . 2013-04-29 16:26 -------- d-----w- j:\program files\Malwarebytes' Anti-Malware2013-04-29 16:26 . 2013-04-04 18:50 22856 ----a-w- j:\windows\system32\drivers\mbam.sys2013-04-29 05:47 . 2013-04-29 05:55 -------- d-----w- j:\windows\system32\drivers\N360\1403010.0162013-04-29 05:34 . 2013-04-29 05:34 -------- d-----w- j:\documents and settings\Bob\Application Data\Malwarebytes2013-04-29 02:20 . 2013-04-29 02:20 -------- d-----w- J:\_OTL2013-04-24 02:02 . 2013-04-24 02:02 -------- d---a-w- J:\$Anvi Rescue Disk$2013-04-23 19:54 . 2013-04-24 01:09 -------- d-----w- j:\windows\Microsoft Antimalware2013-04-23 08:39 . 2013-04-24 02:09 -------- d-----w- j:\documents and settings\Michael2013-04-23 07:57 . 2013-04-23 07:57 -------- d-----w- j:\documents and settings\Michelle\Application Data\Malwarebytes2013-04-23 07:56 . 2013-04-23 07:56 -------- d-----w- j:\documents and settings\All Users\Application Data\Malwarebytes2013-04-23 07:36 . 2013-04-23 07:45 -------- d-----w- j:\documents and settings\All Users\Application Data\2C533BF2BA1AC45700002C530FA4C9762013-04-10 21:04 . 2010-09-07 18:26 28160 ----a-w- j:\windows\system32\drivers\PcaSp50.sys2013-04-10 21:04 . 2006-11-29 01:46 41280 ----a-w- j:\windows\system32\drivers\PCASp50a64.sys2013-04-10 21:04 . 2003-04-22 01:46 61440 ----a-w- j:\windows\system32\ASIW32N50.dll2013-04-10 21:04 . 2002-09-10 23:35 16302 ----a-w- j:\windows\system32\ASINDIS5.sys2013-04-10 21:04 . 2001-04-16 09:48 15577 ----a-w- j:\windows\system32\ASINDIS3.vxd2013-04-10 21:04 . 2013-04-10 21:04 -------- d-----w- j:\program files\ASUS...(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))).2013-04-29 05:48 . 2011-04-16 03:50 142496 ----a-w- j:\windows\system32\drivers\SYMEVENT.SYS2013-03-23 05:22 . 2011-05-21 10:01 1869600 ----a-w- j:\windows\system32\nvcuvenc.dll2013-03-23 05:22 . 2008-07-27 05:18 7536640 ----a-w- j:\windows\system32\nvcuda.dll2013-03-23 05:22 . 2008-07-27 05:18 19189760 ----a-w- j:\windows\system32\nvoglnt.dll2013-03-23 05:22 . 2008-07-27 05:18 12653120 ----a-w- j:\windows\system32\drivers\nv4_mini.sys2013-03-23 05:22 . 2013-03-23 05:22 5967872 ----a-w- j:\windows\system32\nvopencl.dll2013-03-23 05:22 . 2013-03-23 05:22 1010464 ----a-w- j:\windows\system32\nvdispco3230790.dll2013-03-23 05:22 . 2011-05-21 10:01 17551360 ----a-w- j:\windows\system32\nvcompiler.dll2013-03-23 05:22 . 2008-07-27 05:18 4494720 ----a-w- j:\windows\system32\nv4_disp.dll2013-03-23 05:22 . 2013-03-23 05:22 893728 ----a-w- j:\windows\system32\nvdispgenco3230790.dll2013-03-23 05:22 . 2008-07-27 05:18 2392064 ----a-w- j:\windows\system32\nvapi.dll2013-03-23 05:22 . 2011-05-21 10:01 2582816 ----a-w- j:\windows\system32\nvcuvid.dll2013-03-21 22:30 . 2008-07-27 05:18 126976 ----a-w- j:\windows\system32\nvrszht.dll2013-03-21 22:30 . 2008-07-27 05:18 258048 ----a-w- j:\windows\system32\nvrstr.dll2013-03-21 22:30 . 2008-07-27 05:18 258048 ----a-w- j:\windows\system32\nvrssl.dll2013-03-21 22:30 . 2008-07-27 05:18 258048 ----a-w- j:\windows\system32\nvrssk.dll2013-03-21 22:30 . 2008-07-27 05:18 253952 ----a-w- j:\windows\system32\nvrsth.dll2013-03-21 22:30 . 2008-07-27 05:18 253952 ----a-w- j:\windows\system32\nvrssv.dll2013-03-21 22:30 . 2008-07-27 05:18 229376 ----a-w- j:\windows\system32\nvrszhc.dll2013-03-21 22:30 . 2008-07-27 05:18 274432 ----a-w- j:\windows\system32\nvrspt.dll2013-03-21 22:30 . 2008-07-27 05:18 270336 ----a-w- j:\windows\system32\nvrsru.dll2013-03-21 22:30 . 2008-07-27 05:18 270336 ----a-w- j:\windows\system32\nvrsptb.dll2013-03-21 22:30 . 2008-07-27 05:18 258048 ----a-w- j:\windows\system32\nvrspl.dll2013-03-21 22:30 . 2008-07-27 05:18 253952 ----a-w- j:\windows\system32\nvrsno.dll2013-03-21 22:30 . 2008-07-27 05:18 282624 ----a-w- j:\windows\system32\nvrsit.dll2013-03-21 22:30 . 2008-07-27 05:18 274432 ----a-w- j:\windows\system32\nvrsnl.dll2013-03-21 22:30 . 2008-07-27 05:18 274432 ----a-w- j:\windows\system32\nvrsja.dll2013-03-21 22:30 . 2008-07-27 05:18 266240 ----a-w- j:\windows\system32\nvrsko.dll2013-03-21 22:30 . 2008-07-27 05:18 335872 ----a-w- j:\windows\system32\nvrshe.dll2013-03-21 22:30 . 2008-07-27 05:18 286720 ----a-w- j:\windows\system32\nvrsfr.dll2013-03-21 22:30 . 2008-07-27 05:18 262144 ----a-w- j:\windows\system32\nvrshu.dll2013-03-21 22:30 . 2008-07-27 05:18 249856 ----a-w- j:\windows\system32\nvrsfi.dll2013-03-21 22:30 . 2008-07-27 05:18 282624 ----a-w- j:\windows\system32\nvrses.dll2013-03-21 22:30 . 2008-07-27 05:18 282624 ----a-w- j:\windows\system32\nvrsel.dll2013-03-21 22:30 . 2008-07-27 05:18 278528 ----a-w- j:\windows\system32\nvrsde.dll2013-03-21 22:30 . 2008-07-27 05:18 274432 ----a-w- j:\windows\system32\nvrsesm.dll2013-03-21 22:30 . 2008-07-27 05:18 249856 ----a-w- j:\windows\system32\nvrseng.dll2013-03-21 22:30 . 2008-07-27 05:18 335872 ----a-w- j:\windows\system32\nvrsar.dll2013-03-21 22:30 . 2008-07-27 05:18 253952 ----a-w- j:\windows\system32\nvrsda.dll2013-03-21 22:30 . 2008-07-27 05:18 249856 ----a-w- j:\windows\system32\nvrscs.dll2013-03-21 22:26 . 2008-07-27 05:18 54272 ----a-w- j:\windows\system32\nvwddi.dll2013-03-21 22:26 . 2008-07-27 05:18 156448 ----a-w- j:\windows\system32\nvsvc32.exe2013-03-21 22:26 . 2008-07-27 05:18 15517984 ----a-w- j:\windows\system32\nvcpl.dll2013-03-21 22:26 . 2008-07-27 05:18 108832 ----a-w- j:\windows\system32\nvmctray.dll2013-03-21 22:25 . 2008-07-27 05:18 144160 ----a-w- j:\windows\system32\nvcolor.exe2013-03-08 08:36 . 2008-04-14 12:00 293376 ----a-w- j:\windows\system32\winsrv.dll2013-03-07 01:32 . 2008-04-14 12:00 2149888 ----a-w- j:\windows\system32\ntoskrnl.exe2013-03-07 00:50 . 2008-04-14 00:01 2028544 ----a-w- j:\windows\system32\ntkrnlpa.exe2013-03-02 02:06 . 2008-04-14 12:00 916480 ----a-w- j:\windows\system32\wininet.dll2013-03-02 02:06 . 2008-04-14 12:00 43520 ----a-w- j:\windows\system32\licmgr10.dll2013-03-02 02:06 . 2008-04-14 12:00 1469440 ----a-w- j:\windows\system32\inetcpl.cpl2013-03-02 01:25 . 2008-04-14 12:00 1867264 ----a-w- j:\windows\system32\win32k.sys2013-03-02 01:08 . 2008-04-14 12:00 385024 ----a-w- j:\windows\system32\html.iec2013-02-27 07:56 . 2009-03-14 15:33 2067456 ----a-w- j:\windows\system32\mstscax.dll2013-02-12 00:32 . 2008-04-14 12:00 12928 ----a-w- j:\windows\system32\drivers\usb8023.sys..((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shownREGEDIT4.[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"NortonUtilities"="j:\program files\Norton Utilities 14\nu.exe" [2010-08-24 4093288]"SansaDispatch"="j:\documents and settings\Bob\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe" [2011-06-22 79872]"gStart"="j:\garmin\gStart.exe" [2008-08-13 1891416]"Akamai NetSession Interface"="j:\documents and settings\Bob\Local Settings\Application Data\Akamai\netsession_win.exe" [2013-01-26 4480768]"swg"="j:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-03-18 39408].[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"Symantec PIF AlertEng"="j:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 583048]"SSBkgdUpdate"="j:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 155648]"PaperPort PTD"="j:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2005-03-17 57393]"IndexSearch"="j:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2005-03-17 40960]"ControlCenter2.0"="j:\program files\Brother\ControlCenter2\brctrcen.exe" [2007-12-21 86016]"SysTrayApp"="j:\program files\IDT\WDM\sttray.exe" [2008-05-07 413696]"type32"="j:\program files\Microsoft IntelliType Pro\type32.exe" [2004-06-03 172032]"IntelliPoint"="j:\program files\Microsoft IntelliPoint\point32.exe" [2004-06-03 204800]"HPDJ Taskbar Utility"="j:\windows\system32\spool\drivers\w32x86\3\hpztsb11.exe" [2004-04-06 172032]"HPHUPD06"="j:\program files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe" [2004-06-07 49152]"HPHmon06"="j:\windows\system32\hphmon06.exe" [2004-06-07 659456]"Norton Ghost 14.0"="j:\program files\Norton Ghost\Agent\VProTray.exe" [2008-12-11 2245992]"Share-to-Web Namespace Daemon"="j:\program files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" [2001-07-03 57344]"nmctxth"="j:\program files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2008-12-12 642856]"Live! Central 2"="j:\program files\Creative\Creative Live! Cam\Live! Central 2\CTLVCentral2.exe" [2009-08-28 426140]"V0610Mon.exe"="j:\windows\V0610Mon.exe" [2009-08-06 24576]"Monitor"="j:\program files\LeapFrog\LeapFrog Connect\Monitor.exe" [2010-07-28 554328]"BCSSync"="j:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]"BrMfcWnd"="j:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2008-10-11 1085440]"ControlCenter3"="j:\program files\Brother\ControlCenter3\brctrcen.exe" [2007-12-21 86016]"iTunesHelper"="j:\program files\iTunes\iTunesHelper.exe" [2013-02-20 152392]"APSDaemon"="j:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-01-28 59720]"NvMediaCenter"="NvMCTray.dll" [2013-03-21 108832]"QuickTime Task"="j:\program files\QuickTime\qttask.exe" [2012-10-25 421888].j:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk - j:\program files\HP\digital imaging\bin\hpqtra08.exe [2004-5-28 241664]HP Image Zone Fast Start.lnk - j:\program files\HP\digital imaging\bin\hpqthb08.exe [2004-5-28 53248]NCProTray.lnk - j:\program files\SEC\Natural Color Pro\NCProTray.exe [2009-3-14 49220]Windows Search.lnk - j:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904].[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]"ConsentPromptBehaviorAdmin"= 5 (0x5)"EnableUIADesktopToggle"= 0 (0x0)"ConsentPromptBehaviorUser"= 3 (0x3).[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]"NoAdminPage"= 0 (0x0).[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]"NoChangeStartMenu"= 00000000"MaxRecentDocs"= 0 (0x0)"NoWinKey"= 0 (0x0)"NoNetConnextDisconnect"= 0 (0x0)"NoSMConfigurePrograms"= 0 (0x0)"NoControlPanle"= 0 (0x0).[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "j:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DiskeeperSystrayHKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component ManagerHKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software UpdateHKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheckHKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemonHKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwizHKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime TaskHKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg.[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]"DisableMonitoring"=dword:00000001.[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]"DisableMonitoring"=dword:00000001.[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]"DisableMonitoring"=dword:00000001.[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]"%windir%\\system32\\sessmgr.exe"="j:\\Documents and Settings\\Bob\\Local Settings\\Application Data\\Akamai\\netsession_win.exe"="j:\\Program Files\\NVIDIA Corporation\\NVIDIA Update Core\\daemonu.exe"=.[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]"5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management"1131:TCP"= 1131:TCP:Akamai NetSession Interface"5000:UDP"= 5000:UDP:Akamai NetSession Interface.R0 SymDS;Symantec Data Store;j:\windows\system32\drivers\N360\1403010.016\symds.sys [4/29/2013 1:47 AM 367704]R0 SymEFA;Symantec Extended File Attributes;j:\windows\system32\drivers\N360\1403010.016\symefa.sys [4/29/2013 1:47 AM 934488]S0 Lbd;Lbd;j:\windows\system32\DRIVERS\Lbd.sys --> j:\windows\system32\DRIVERS\Lbd.sys [?]S1 BHDrvx86;BHDrvx86;j:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\BASHDefs\20130412.001\BHDrvx86.sys [4/12/2013 7:53 PM 1000024]S1 ccSet_N360;Norton 360 Settings Manager;j:\windows\system32\drivers\N360\1403010.016\ccsetx86.sys [4/29/2013 1:47 AM 134304]S1 SymIRON;Symantec Iron Driver;j:\windows\system32\drivers\N360\1403010.016\ironx86.sys [4/29/2013 1:47 AM 175264]S2 gupdate1c9a76164ab2998;Google Update Service (gupdate1c9a76164ab2998);j:\program files\Google\Update\GoogleUpdate.exe [3/17/2009 8:35 PM 133104]S2 IntuitUpdateServiceV4;Intuit Update Service v4;j:\program files\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe [8/23/2012 12:37 PM 13672]S2 LinksysUpdater;Linksys Updater;j:\program files\Linksys\Linksys Updater\bin\LinksysUpdater.exe [11/13/2008 3:43 PM 204800]S2 N360;Norton 360;j:\program files\Norton 360\Engine\20.3.1.22\ccsvchst.exe [4/29/2013 1:47 AM 144520]S2 SkypeUpdate;Skype Updater;j:\program files\Skype\Updater\Updater.exe [7/13/2012 2:28 PM 160944]S2 Symantec SymSnap VSS Provider;Symantec SymSnap VSS Provider;j:\windows\system32\dllhost.exe [4/14/2008 8:00 AM 5120]S3 CtClsFlt;Creative Camera Class Upper Filter Driver;j:\windows\system32\drivers\CtClsFlt.sys [8/8/2010 7:56 PM 143936]S3 DCamUSBIntel;USB Video Camera for Intel Proshare technology;j:\windows\system32\drivers\usbintel.sys [4/13/2008 8:15 PM 15872]S3 EraserUtilRebootDrv;EraserUtilRebootDrv;j:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [4/21/2013 8:42 PM 106656]S3 IDSxpx86;IDSxpx86;j:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\IPSDefs\20130503.001\IDSXpx86.sys [5/3/2013 9:31 PM 373728]S3 nosGetPlusHelper;getPlus® Helper 3004;j:\windows\System32\svchost.exe -k nosGetPlusHelper [4/14/2008 8:00 AM 14336]S3 SymSnapService;SymSnapService;j:\program files\Norton Ghost\Shared\Drivers\SymSnapService.exe [12/20/2007 5:13 PM 1558000]S3 V0610Afx;Creative Camera VF0610 Audio Effects Driver;j:\windows\system32\drivers\V0610Afx.sys [8/8/2010 7:59 PM 160256]S3 V0610Vid;Creative Live! Cam Socialize HD Driver;j:\windows\system32\drivers\V0610Vid.sys [8/8/2010 7:58 PM 274624].[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]nosGetPlusHelper REG_MULTI_SZ nosGetPlusHelper.Contents of the 'Scheduled Tasks' folder.2013-05-02 j:\windows\Tasks\AppleSoftwareUpdate.job- j:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 21:57].2013-05-03 j:\windows\Tasks\Google Software Updater.job- j:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-03-18 15:51].2013-05-04 j:\windows\Tasks\GoogleUpdateTaskMachineCore.job- j:\program files\Google\Update\GoogleUpdate.exe [2009-03-18 00:35].2013-05-04 j:\windows\Tasks\GoogleUpdateTaskMachineUA.job- j:\program files\Google\Update\GoogleUpdate.exe [2009-03-18 00:35]..------- Supplementary Scan -------.uStart Page = hxxp://www.google.com/uInternet Settings,ProxyOverride = *.local;<local>uSearchAssistant = hxxp://www.google.com/ieuSearchURL,(Default) = hxxp://www.google.com/search?q=%sTCP: DhcpNameServer = 192.168.1.1DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} - hxxp://77.105.97.97:8000/activex/AMC.cab.- - - - ORPHANS REMOVED - - - -.Toolbar-Locked - (no file)MSConfigStartUp-CTFMON - (no file)...**************************************************************************.catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.netRootkit scan 2013-05-03 22:27Windows 5.1.2600 Service Pack 3 NTFS.scanning hidden processes ... .scanning hidden autostart entries ....HKCU\Software\Microsoft\Windows\CurrentVersion\Run SansaDispatch = j:\documents and settings\Bob\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe??1?"?>? ? ?<?h?e?a?d?>? ? ?<?t?i?t?l?e?>?I?F?r?a?m?e? ?G?e?n?e?r?i?c? ?M?e?s?s?a?g?e?<.scanning hidden files ... .scan completed successfullyhidden files: 0.**************************************************************************.[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\N360]"ImagePath"="\"j:\program files\Norton 360\Engine\20.3.1.22\ccSvcHst.exe\" /s \"N360\" /m \"j:\program files\Norton 360\Engine\20.3.1.22\diMaster.dll\" /prefetch:1".--------------------- LOCKED REGISTRY KEYS ---------------------.[HKEY_USERS\S-1-5-21-57989841-1078081533-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*# #´]@Class="Shell".[HKEY_LOCAL_MACHINE\software\Classes\.xml\PersistentHandler]@DACL=(02 0000)@="{7E9D8D44-6926-426F-AA2B-217A819A5CCE}".[HKEY_LOCAL_MACHINE\software\Classes\.xsl\PersistentHandler]@DACL=(02 0000)@="{7E9D8D44-6926-426F-AA2B-217A819A5CCE}".Completion time: 2013-05-03 22:29:53ComboFix-quarantined-files.txt 2013-05-04 02:29.Pre-Run: 937,039,290,368 bytes freePost-Run: 937,419,485,184 bytes free.- - End Of File - - 51E39FED1AC76AF7933B93AD9F9EAB5C Link to post Share on other sites More sharing options...
MrCharlie Posted May 4, 2013 ID:676148 Share Posted May 4, 2013 Using ComboFix......1. Close any open browsers.2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.3. Open notepad and copy/paste the text in the quotebox below into it:4. If ComboFix wants to update.....please allow it to.NoMBR::SecCenter::AV: Lavasoft Ad-Watch Live! Anti-Virus *Disabled/Updated* {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}ClearJavaCache::Save this as CFScript.txt, in the same location as ComboFix.exeRefering to the picture above, drag CFScript into ComboFix.exeCAUTION: Do not mouse-click ComboFix while it is running. It may cause it to stall.After reboot, (in case it asks to reboot)......Please provide the contents of the ComboFix log (C:\ComboFix.txt) in your next reply.MrC Link to post Share on other sites More sharing options...
oasis Posted May 5, 2013 Author ID:676316 Share Posted May 5, 2013 Ran ComboFix with the script. Log below.The Windows Security Center reference to Lavasoft went away but now it simply reports that no antivirus software is installed (when in fact Norton 360 is running).The pop-up message balloon appears from the sys tray on boot.Also, it now appears that Windows firewall is on when the PC first boots, but it then shuts off about 2 minutes after the desktop appears in the boot process.An additional message then appears in the same pop-up balloon from the sys tray warning that the frewall is off.Then after about another minute, it turns itself back on again and teh message disappears.Norton 360 also runs its own "smart firewall" that seems to be undetected by Windows Security Center.ComboFix 13-05-04.01 - Bob 05/04/2013 23:44:56.2.4 - x86Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3323.2384 [GMT -4:00]Running from: j:\documents and settings\Bob\Desktop\ComboFix.exeCommand switches used :: j:\documents and settings\Bob\Desktop\CFScript.txt..((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))..j:\documents and settings\All Users\Application Data\TEMP..((((((((((((((((((((((((( Files Created from 2013-04-05 to 2013-05-05 )))))))))))))))))))))))))))))))..2013-05-03 21:55 . 2013-05-03 21:56 -------- d-----w- j:\documents and settings\Administrator2013-05-03 03:03 . 2013-05-03 03:04 -------- d-----w- j:\documents and settings\Bob\Application Data\Foxit Software2013-05-03 03:03 . 2013-05-03 03:03 -------- d-----w- j:\program files\Foxit Software2013-05-03 02:37 . 2013-05-03 02:37 -------- d-----w- j:\windows\system32\wbem\Repository2013-05-02 18:30 . 2013-05-02 18:30 159744 ----a-w- j:\program files\Internet Explorer\Plugins\npqtplugin7.dll2013-05-02 18:30 . 2013-05-02 18:30 159744 ----a-w- j:\program files\Internet Explorer\Plugins\npqtplugin6.dll2013-05-02 18:30 . 2013-05-02 18:30 159744 ----a-w- j:\program files\Internet Explorer\Plugins\npqtplugin5.dll2013-05-02 18:30 . 2013-05-02 18:30 159744 ----a-w- j:\program files\Internet Explorer\Plugins\npqtplugin4.dll2013-05-02 18:30 . 2013-05-02 18:30 159744 ----a-w- j:\program files\Internet Explorer\Plugins\npqtplugin3.dll2013-05-02 18:30 . 2013-05-02 18:30 159744 ----a-w- j:\program files\Internet Explorer\Plugins\npqtplugin2.dll2013-05-02 18:30 . 2013-05-02 18:30 159744 ----a-w- j:\program files\Internet Explorer\Plugins\npqtplugin.dll2013-05-02 18:30 . 2013-05-02 18:30 -------- d-----w- j:\program files\QuickTime2013-05-01 01:04 . 2013-05-01 01:04 -------- d-----w- j:\program files\ERUNT2013-04-30 02:15 . 2013-04-30 02:15 -------- d-----w- j:\documents and settings\All Users\Application Data\McAfee2013-04-29 22:55 . 2013-04-29 22:55 -------- d-----w- j:\windows\system32\winrm2013-04-29 22:55 . 2013-04-29 22:55 -------- dc-h--w- j:\windows\$968930Uinstall_KB968930$2013-04-29 20:13 . 2013-05-05 03:42 -------- d-----w- j:\windows\system32\CatRoot22013-04-29 18:01 . 2013-05-01 03:41 181064 ----a-w- j:\windows\PSEXESVC.EXE2013-04-29 17:57 . 2013-04-29 17:57 -------- d-----w- J:\RegBackup2013-04-29 16:26 . 2013-04-29 16:26 -------- d-----w- j:\program files\Malwarebytes' Anti-Malware2013-04-29 16:26 . 2013-04-04 18:50 22856 ----a-w- j:\windows\system32\drivers\mbam.sys2013-04-29 05:47 . 2013-04-29 05:55 -------- d-----w- j:\windows\system32\drivers\N360\1403010.0162013-04-29 05:34 . 2013-04-29 05:34 -------- d-----w- j:\documents and settings\Bob\Application Data\Malwarebytes2013-04-29 02:20 . 2013-04-29 02:20 -------- d-----w- J:\_OTL2013-04-24 02:02 . 2013-04-24 02:02 -------- d---a-w- J:\$Anvi Rescue Disk$2013-04-23 19:54 . 2013-04-24 01:09 -------- d-----w- j:\windows\Microsoft Antimalware2013-04-23 08:39 . 2013-04-24 02:09 -------- d-----w- j:\documents and settings\Michael2013-04-23 07:57 . 2013-04-23 07:57 -------- d-----w- j:\documents and settings\Michelle\Application Data\Malwarebytes2013-04-23 07:56 . 2013-04-23 07:56 -------- d-----w- j:\documents and settings\All Users\Application Data\Malwarebytes2013-04-23 07:36 . 2013-04-23 07:45 -------- d-----w- j:\documents and settings\All Users\Application Data\2C533BF2BA1AC45700002C530FA4C9762013-04-10 21:04 . 2010-09-07 18:26 28160 ----a-w- j:\windows\system32\drivers\PcaSp50.sys2013-04-10 21:04 . 2006-11-29 01:46 41280 ----a-w- j:\windows\system32\drivers\PCASp50a64.sys2013-04-10 21:04 . 2003-04-22 01:46 61440 ----a-w- j:\windows\system32\ASIW32N50.dll2013-04-10 21:04 . 2002-09-10 23:35 16302 ----a-w- j:\windows\system32\ASINDIS5.sys2013-04-10 21:04 . 2001-04-16 09:48 15577 ----a-w- j:\windows\system32\ASINDIS3.vxd2013-04-10 21:04 . 2013-04-10 21:04 -------- d-----w- j:\program files\ASUS...(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))).2013-04-29 05:48 . 2011-04-16 03:50 142496 ----a-w- j:\windows\system32\drivers\SYMEVENT.SYS2013-03-23 05:22 . 2011-05-21 10:01 1869600 ----a-w- j:\windows\system32\nvcuvenc.dll2013-03-23 05:22 . 2008-07-27 05:18 7536640 ----a-w- j:\windows\system32\nvcuda.dll2013-03-23 05:22 . 2008-07-27 05:18 19189760 ----a-w- j:\windows\system32\nvoglnt.dll2013-03-23 05:22 . 2008-07-27 05:18 12653120 ----a-w- j:\windows\system32\drivers\nv4_mini.sys2013-03-23 05:22 . 2013-03-23 05:22 5967872 ----a-w- j:\windows\system32\nvopencl.dll2013-03-23 05:22 . 2013-03-23 05:22 1010464 ----a-w- j:\windows\system32\nvdispco3230790.dll2013-03-23 05:22 . 2011-05-21 10:01 17551360 ----a-w- j:\windows\system32\nvcompiler.dll2013-03-23 05:22 . 2008-07-27 05:18 4494720 ----a-w- j:\windows\system32\nv4_disp.dll2013-03-23 05:22 . 2013-03-23 05:22 893728 ----a-w- j:\windows\system32\nvdispgenco3230790.dll2013-03-23 05:22 . 2008-07-27 05:18 2392064 ----a-w- j:\windows\system32\nvapi.dll2013-03-23 05:22 . 2011-05-21 10:01 2582816 ----a-w- j:\windows\system32\nvcuvid.dll2013-03-21 22:30 . 2008-07-27 05:18 126976 ----a-w- j:\windows\system32\nvrszht.dll2013-03-21 22:30 . 2008-07-27 05:18 258048 ----a-w- j:\windows\system32\nvrstr.dll2013-03-21 22:30 . 2008-07-27 05:18 258048 ----a-w- j:\windows\system32\nvrssl.dll2013-03-21 22:30 . 2008-07-27 05:18 258048 ----a-w- j:\windows\system32\nvrssk.dll2013-03-21 22:30 . 2008-07-27 05:18 253952 ----a-w- j:\windows\system32\nvrsth.dll2013-03-21 22:30 . 2008-07-27 05:18 253952 ----a-w- j:\windows\system32\nvrssv.dll2013-03-21 22:30 . 2008-07-27 05:18 229376 ----a-w- j:\windows\system32\nvrszhc.dll2013-03-21 22:30 . 2008-07-27 05:18 274432 ----a-w- j:\windows\system32\nvrspt.dll2013-03-21 22:30 . 2008-07-27 05:18 270336 ----a-w- j:\windows\system32\nvrsru.dll2013-03-21 22:30 . 2008-07-27 05:18 270336 ----a-w- j:\windows\system32\nvrsptb.dll2013-03-21 22:30 . 2008-07-27 05:18 258048 ----a-w- j:\windows\system32\nvrspl.dll2013-03-21 22:30 . 2008-07-27 05:18 253952 ----a-w- j:\windows\system32\nvrsno.dll2013-03-21 22:30 . 2008-07-27 05:18 282624 ----a-w- j:\windows\system32\nvrsit.dll2013-03-21 22:30 . 2008-07-27 05:18 274432 ----a-w- j:\windows\system32\nvrsnl.dll2013-03-21 22:30 . 2008-07-27 05:18 274432 ----a-w- j:\windows\system32\nvrsja.dll2013-03-21 22:30 . 2008-07-27 05:18 266240 ----a-w- j:\windows\system32\nvrsko.dll2013-03-21 22:30 . 2008-07-27 05:18 335872 ----a-w- j:\windows\system32\nvrshe.dll2013-03-21 22:30 . 2008-07-27 05:18 286720 ----a-w- j:\windows\system32\nvrsfr.dll2013-03-21 22:30 . 2008-07-27 05:18 262144 ----a-w- j:\windows\system32\nvrshu.dll2013-03-21 22:30 . 2008-07-27 05:18 249856 ----a-w- j:\windows\system32\nvrsfi.dll2013-03-21 22:30 . 2008-07-27 05:18 282624 ----a-w- j:\windows\system32\nvrses.dll2013-03-21 22:30 . 2008-07-27 05:18 282624 ----a-w- j:\windows\system32\nvrsel.dll2013-03-21 22:30 . 2008-07-27 05:18 278528 ----a-w- j:\windows\system32\nvrsde.dll2013-03-21 22:30 . 2008-07-27 05:18 274432 ----a-w- j:\windows\system32\nvrsesm.dll2013-03-21 22:30 . 2008-07-27 05:18 249856 ----a-w- j:\windows\system32\nvrseng.dll2013-03-21 22:30 . 2008-07-27 05:18 335872 ----a-w- j:\windows\system32\nvrsar.dll2013-03-21 22:30 . 2008-07-27 05:18 253952 ----a-w- j:\windows\system32\nvrsda.dll2013-03-21 22:30 . 2008-07-27 05:18 249856 ----a-w- j:\windows\system32\nvrscs.dll2013-03-21 22:26 . 2008-07-27 05:18 54272 ----a-w- j:\windows\system32\nvwddi.dll2013-03-21 22:26 . 2008-07-27 05:18 156448 ----a-w- j:\windows\system32\nvsvc32.exe2013-03-21 22:26 . 2008-07-27 05:18 15517984 ----a-w- j:\windows\system32\nvcpl.dll2013-03-21 22:26 . 2008-07-27 05:18 108832 ----a-w- j:\windows\system32\nvmctray.dll2013-03-21 22:25 . 2008-07-27 05:18 144160 ----a-w- j:\windows\system32\nvcolor.exe2013-03-08 08:36 . 2008-04-14 12:00 293376 ----a-w- j:\windows\system32\winsrv.dll2013-03-07 01:32 . 2008-04-14 12:00 2149888 ----a-w- j:\windows\system32\ntoskrnl.exe2013-03-07 00:50 . 2008-04-14 00:01 2028544 ----a-w- j:\windows\system32\ntkrnlpa.exe2013-03-02 02:06 . 2008-04-14 12:00 916480 ----a-w- j:\windows\system32\wininet.dll2013-03-02 02:06 . 2008-04-14 12:00 43520 ----a-w- j:\windows\system32\licmgr10.dll2013-03-02 02:06 . 2008-04-14 12:00 1469440 ----a-w- j:\windows\system32\inetcpl.cpl2013-03-02 01:25 . 2008-04-14 12:00 1867264 ----a-w- j:\windows\system32\win32k.sys2013-03-02 01:08 . 2008-04-14 12:00 385024 ----a-w- j:\windows\system32\html.iec2013-02-27 07:56 . 2009-03-14 15:33 2067456 ----a-w- j:\windows\system32\mstscax.dll2013-02-12 00:32 . 2008-04-14 12:00 12928 ----a-w- j:\windows\system32\drivers\usb8023.sys..((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shownREGEDIT4.[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"NortonUtilities"="j:\program files\Norton Utilities 14\nu.exe" [2010-08-24 4093288]"SansaDispatch"="j:\documents and settings\Bob\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe" [2011-06-22 79872]"gStart"="j:\garmin\gStart.exe" [2008-08-13 1891416]"Akamai NetSession Interface"="j:\documents and settings\Bob\Local Settings\Application Data\Akamai\netsession_win.exe" [2013-01-26 4480768]"swg"="j:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-03-18 39408].[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"Symantec PIF AlertEng"="j:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 583048]"SSBkgdUpdate"="j:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 155648]"PaperPort PTD"="j:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2005-03-17 57393]"IndexSearch"="j:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2005-03-17 40960]"ControlCenter2.0"="j:\program files\Brother\ControlCenter2\brctrcen.exe" [2007-12-21 86016]"SysTrayApp"="j:\program files\IDT\WDM\sttray.exe" [2008-05-07 413696]"type32"="j:\program files\Microsoft IntelliType Pro\type32.exe" [2004-06-03 172032]"IntelliPoint"="j:\program files\Microsoft IntelliPoint\point32.exe" [2004-06-03 204800]"HPDJ Taskbar Utility"="j:\windows\system32\spool\drivers\w32x86\3\hpztsb11.exe" [2004-04-06 172032]"HPHUPD06"="j:\program files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe" [2004-06-07 49152]"HPHmon06"="j:\windows\system32\hphmon06.exe" [2004-06-07 659456]"Norton Ghost 14.0"="j:\program files\Norton Ghost\Agent\VProTray.exe" [2008-12-11 2245992]"Share-to-Web Namespace Daemon"="j:\program files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" [2001-07-03 57344]"nmctxth"="j:\program files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2008-12-12 642856]"Live! Central 2"="j:\program files\Creative\Creative Live! Cam\Live! Central 2\CTLVCentral2.exe" [2009-08-28 426140]"V0610Mon.exe"="j:\windows\V0610Mon.exe" [2009-08-06 24576]"Monitor"="j:\program files\LeapFrog\LeapFrog Connect\Monitor.exe" [2010-07-28 554328]"BCSSync"="j:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]"BrMfcWnd"="j:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2008-10-11 1085440]"ControlCenter3"="j:\program files\Brother\ControlCenter3\brctrcen.exe" [2007-12-21 86016]"iTunesHelper"="j:\program files\iTunes\iTunesHelper.exe" [2013-02-20 152392]"APSDaemon"="j:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-01-28 59720]"NvMediaCenter"="NvMCTray.dll" [2013-03-21 108832]"QuickTime Task"="j:\program files\QuickTime\qttask.exe" [2012-10-25 421888].j:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk - j:\program files\HP\digital imaging\bin\hpqtra08.exe [2004-5-28 241664]HP Image Zone Fast Start.lnk - j:\program files\HP\digital imaging\bin\hpqthb08.exe [2004-5-28 53248]NCProTray.lnk - j:\program files\SEC\Natural Color Pro\NCProTray.exe [2009-3-14 49220]Windows Search.lnk - j:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904].[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]"ConsentPromptBehaviorAdmin"= 5 (0x5)"EnableUIADesktopToggle"= 0 (0x0)"ConsentPromptBehaviorUser"= 3 (0x3).[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]"NoAdminPage"= 0 (0x0).[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]"NoChangeStartMenu"= 00000000"MaxRecentDocs"= 0 (0x0)"NoWinKey"= 0 (0x0)"NoNetConnextDisconnect"= 0 (0x0)"NoSMConfigurePrograms"= 0 (0x0)"NoControlPanle"= 0 (0x0).[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "j:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128].[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]"DisableMonitoring"=dword:00000001.[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]"DisableMonitoring"=dword:00000001.[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]"DisableMonitoring"=dword:00000001.[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]"EnableFirewall"= 0 (0x0).[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]"%windir%\\system32\\sessmgr.exe"="j:\\Documents and Settings\\Bob\\Local Settings\\Application Data\\Akamai\\netsession_win.exe"="j:\\Program Files\\NVIDIA Corporation\\NVIDIA Update Core\\daemonu.exe"=.[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]"5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management.R0 SymDS;Symantec Data Store;j:\windows\system32\drivers\N360\1403010.016\symds.sys [4/29/2013 1:47 AM 367704]R0 SymEFA;Symantec Extended File Attributes;j:\windows\system32\drivers\N360\1403010.016\symefa.sys [4/29/2013 1:47 AM 934488]R1 BHDrvx86;BHDrvx86;j:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\BASHDefs\20130412.001\BHDrvx86.sys [4/12/2013 7:53 PM 1000024]R1 ccSet_N360;Norton 360 Settings Manager;j:\windows\system32\drivers\N360\1403010.016\ccsetx86.sys [4/29/2013 1:47 AM 134304]R1 SymIRON;Symantec Iron Driver;j:\windows\system32\drivers\N360\1403010.016\ironx86.sys [4/29/2013 1:47 AM 175264]R2 IntuitUpdateServiceV4;Intuit Update Service v4;j:\program files\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe [8/23/2012 12:37 PM 13672]R2 N360;Norton 360;j:\program files\Norton 360\Engine\20.3.1.22\ccsvchst.exe [4/29/2013 1:47 AM 144520]R3 CtClsFlt;Creative Camera Class Upper Filter Driver;j:\windows\system32\drivers\CtClsFlt.sys [8/8/2010 7:56 PM 143936]R3 EraserUtilRebootDrv;EraserUtilRebootDrv;j:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [4/21/2013 8:42 PM 106656]R3 IDSxpx86;IDSxpx86;j:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\IPSDefs\20130503.001\IDSXpx86.sys [5/3/2013 9:31 PM 373728]R3 SymSnapService;SymSnapService;j:\program files\Norton Ghost\Shared\Drivers\SymSnapService.exe [12/20/2007 5:13 PM 1558000]S0 Lbd;Lbd;j:\windows\system32\DRIVERS\Lbd.sys --> j:\windows\system32\DRIVERS\Lbd.sys [?]S2 gupdate1c9a76164ab2998;Google Update Service (gupdate1c9a76164ab2998);j:\program files\Google\Update\GoogleUpdate.exe [3/17/2009 8:35 PM 133104]S2 LinksysUpdater;Linksys Updater;j:\program files\Linksys\Linksys Updater\bin\LinksysUpdater.exe [11/13/2008 3:43 PM 204800]S2 SkypeUpdate;Skype Updater;j:\program files\Skype\Updater\Updater.exe [7/13/2012 2:28 PM 160944]S2 Symantec SymSnap VSS Provider;Symantec SymSnap VSS Provider;j:\windows\system32\dllhost.exe [4/14/2008 8:00 AM 5120]S3 DCamUSBIntel;USB Video Camera for Intel Proshare technology;j:\windows\system32\drivers\usbintel.sys [4/13/2008 8:15 PM 15872]S3 nosGetPlusHelper;getPlus® Helper 3004;j:\windows\System32\svchost.exe -k nosGetPlusHelper [4/14/2008 8:00 AM 14336]S3 V0610Afx;Creative Camera VF0610 Audio Effects Driver;j:\windows\system32\drivers\V0610Afx.sys [8/8/2010 7:59 PM 160256]S3 V0610Vid;Creative Live! Cam Socialize HD Driver;j:\windows\system32\drivers\V0610Vid.sys [8/8/2010 7:58 PM 274624].[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]nosGetPlusHelper REG_MULTI_SZ nosGetPlusHelper.Contents of the 'Scheduled Tasks' folder.2013-05-02 j:\windows\Tasks\AppleSoftwareUpdate.job- j:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 21:57].2013-05-04 j:\windows\Tasks\Google Software Updater.job- j:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-03-18 15:51].2013-05-05 j:\windows\Tasks\GoogleUpdateTaskMachineCore.job- j:\program files\Google\Update\GoogleUpdate.exe [2009-03-18 00:35].2013-05-05 j:\windows\Tasks\GoogleUpdateTaskMachineUA.job- j:\program files\Google\Update\GoogleUpdate.exe [2009-03-18 00:35]..------- Supplementary Scan -------.uStart Page = hxxp://www.google.com/uInternet Settings,ProxyOverride = *.local;<local>uSearchAssistant = hxxp://www.google.com/ieuSearchURL,(Default) = hxxp://www.google.com/search?q=%sTCP: DhcpNameServer = 192.168.1.1DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} - hxxp://77.105.97.97:8000/activex/AMC.cab..**************************************************************************.catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.netRootkit scan 2013-05-04 23:50Windows 5.1.2600 Service Pack 3 NTFS.scanning hidden processes ... .scanning hidden autostart entries ....HKCU\Software\Microsoft\Windows\CurrentVersion\Run SansaDispatch = j:\documents and settings\Bob\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe??1?"?>? ? ?<?h?e?a?d?>? ? ?<?t?i?t?l?e?>?I?F?r?a?m?e? ?G?e?n?e?r?i?c? ?M?e?s?s?a?g?e?<.scanning hidden files ... .scan completed successfullyhidden files: 0.**************************************************************************.[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\N360]"ImagePath"="\"j:\program files\Norton 360\Engine\20.3.1.22\ccSvcHst.exe\" /s \"N360\" /m \"j:\program files\Norton 360\Engine\20.3.1.22\diMaster.dll\" /prefetch:1".--------------------- LOCKED REGISTRY KEYS ---------------------.[HKEY_USERS\S-1-5-21-57989841-1078081533-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*# #´]@Class="Shell".[HKEY_LOCAL_MACHINE\software\Classes\.xml\PersistentHandler]@DACL=(02 0000)@="{7E9D8D44-6926-426F-AA2B-217A819A5CCE}".[HKEY_LOCAL_MACHINE\software\Classes\.xsl\PersistentHandler]@DACL=(02 0000)@="{7E9D8D44-6926-426F-AA2B-217A819A5CCE}".--------------------- DLLs Loaded Under Running Processes ---------------------.- - - - - - - > 'explorer.exe'(4452)j:\windows\system32\WININET.dllj:\progra~1\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odfj:\progra~1\MICROS~2\Office14\1033\GrooveIntlResource.dllj:\program files\Windows Desktop Search\deskbar.dllj:\program files\Windows Desktop Search\en-us\dbres.dll.muij:\program files\Windows Desktop Search\dbres.dllj:\program files\Windows Desktop Search\wordwheel.dllj:\program files\Windows Desktop Search\en-us\msnlExtRes.dll.muij:\program files\Windows Desktop Search\msnlExtRes.dllj:\windows\system32\ieframe.dllj:\windows\system32\webcheck.dllj:\windows\system32\WPDShServiceObj.dllj:\windows\system32\PortableDeviceTypes.dllj:\windows\system32\PortableDeviceApi.dll.Completion time: 2013-05-04 23:52:09ComboFix-quarantined-files.txt 2013-05-05 03:52ComboFix2.txt 2013-05-04 02:29.Pre-Run: 936,661,970,944 bytes freePost-Run: 936,673,763,328 bytes free.- - End Of File - - 8F5B20875F424E6F234213486DB4EE61 Link to post Share on other sites More sharing options...
MrCharlie Posted May 5, 2013 ID:676351 Share Posted May 5, 2013 If Norton has a firewall, then you don't want to use Windows firewall.See if you can run a DDS scan now:http://forums.malwarebytes.org/index.php?showtopic=9573MrC Link to post Share on other sites More sharing options...
oasis Posted May 5, 2013 Author ID:676473 Share Posted May 5, 2013 Can't get DDS scan to complete. It appears to launch and there is disk activity, along with the displayed message "Two logs shall be created on your desktop". After that it just hangs and never produces the log files. Also tried to run it in safe mode with same result. Link to post Share on other sites More sharing options...
MrCharlie Posted May 5, 2013 ID:676477 Share Posted May 5, 2013 Can you try it with all your anti-virus/malware programs disabled.MrC Link to post Share on other sites More sharing options...
oasis Posted May 6, 2013 Author ID:676584 Share Posted May 6, 2013 I had antivirus disabled on the first try. I think in safe mode they may not even launch anyway. Do I also need to disable firewalls? Link to post Share on other sites More sharing options...
MrCharlie Posted May 6, 2013 ID:676603 Share Posted May 6, 2013 No, you shouldn't have to, MrC Link to post Share on other sites More sharing options...
oasis Posted May 6, 2013 Author ID:676655 Share Posted May 6, 2013 Any other ideas on how to get it to run? Aready tried w/ Norton 360 Antivirus disabled.How long should a typical scan take with DDS?Thanks. Link to post Share on other sites More sharing options...
MrCharlie Posted May 6, 2013 ID:676656 Share Posted May 6, 2013 It could take up to 10 minutes, MrC Link to post Share on other sites More sharing options...
Recommended Posts