Getting redirected

needafix · August 16, 2010

Hi Guys,

I hope you can help.

I recently began having this problem and Symantic Endpoint Protection and AMWBytes has been unable to find the cause.

When clicking on the search results of Google or when opening up an email in Hotmail, I am being redirected.(Not every time but often)

Sometimes redirected to some laim search results page, sometimes to random pages like yellow pages results, sometimes a video tries to load and start playing.

What do you suggest?

Thanks in advance for your help!

needafix · August 16, 2010

Hi Guys,
I hope you can help.
I recently began having this problem and Symantic Endpoint Protection and AMWBytes has been unable to find the cause.
When clicking on the search results of Google or when opening up an email in Hotmail, I am being redirected.(Not every time but often)
Sometimes redirected to some laim search results page, sometimes to random pages like yellow pages results, sometimes a video tries to load and start playing.
What do you suggest?
Thanks in advance for your help!

This was the most recent AMWB results:

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4434

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

8/15/2010 7:45:27 PM

mbam-log-2010-08-15 (19-45-27).txt

Scan type: Full scan (C:\|D:\|)

Objects scanned: 208265

Time elapsed: 59 minute(s), 48 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

needafix · August 16, 2010

Hi,

I am new to this so don't know how long long it usually takes to hear back from someone but I wanted to add also that I recently wiped out my hard drive and reinstalled the op. sys. because of a virus/malware (Malware Doctor??).

Shortly afterwards is when this redirecting started.

I hope someone can help me with this.

Thanks so much!

needafix · August 17, 2010

Going out of the country Saturday.

I don't want to be a pain in the neck but do you think it is possible to get some assistance before I go?

If not, I will need to repost when I get back.

Thanks so much!!

screen317 · August 18, 2010

Hi and welcome to Malwarebytes.

Please update MBAM, run a Quick Scan, and post its log.

Next, download DDS by sUBs and save it to your Desktop.

Double-click on the DDS icon and let the scan run. When it has run two logs will be produced, please post the one that is not minimized.

needafix · August 18, 2010

Hi and welcome to Malwarebytes.
Please update MBAM, run a Quick Scan, and post its log.
Next, download DDS by sUBs and save it to your Desktop.
Double-click on the DDS icon and let the scan run. When it has run two logs will be produced, please post the one that is not minimized.

Chris,

First, Thanks so much for your help!!

Next, I wanted to let you know that Verizon FIOS, My ISP, has provided me with a static DNS address to try to prevent redirecting while my system is cleaned up.

Here is the MBAM results to look at while I run the next scan:

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4442

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

8/17/2010 9:41:37 PM

mbam-log-2010-08-17 (21-41-37).txt

Scan type: Quick scan

Objects scanned: 156807

Time elapsed: 17 minute(s), 33 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

needafix · August 18, 2010

Chris,
First, Thanks so much for your help!!
Next, I wanted to let you know that Verizon FIOS, My ISP, has provided me with a static DNS address to try to prevent redirecting while my system is cleaned up.
Here is the MBAM results to look at while I run the next scan:
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org
Database version: 4442
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
8/17/2010 9:41:37 PM
mbam-log-2010-08-17 (21-41-37).txt
Scan type: Quick scan
Objects scanned: 156807
Time elapsed: 17 minute(s), 33 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)

OK. Here is the other scan:

DDS (Ver_10-03-17.01) - NTFSx86

Run by Alan at 21:46:59.32 on Tue 08/17/2010

Internet Explorer: 8.0.6001.18702

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.503.144 [GMT -4:00]

AV: Symantec Endpoint Protection *On-access scanning enabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}

FW: Symantec Endpoint Protection *enabled* {BE898FE3-CD0B-4014-85A9-03DB9923DDB6}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe

svchost.exe

C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

C:\WINDOWS\System32\svchost.exe -k imgsvc

C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe

C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\AGRSMMSG.exe

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe

C:\Program Files\Toshiba\Tvs\TvsTray.exe

C:\WINDOWS\PixArt\PAC7302\Monitor.exe

C:\WINDOWS\System32\svchost.exe -k HTTPFilter

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe

C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe

C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe

C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe

C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Documents and Settings\Alan\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://co114w.col114.mail.live.com/default.aspx?wa=wsignin1.0

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

BHO: Skype add-on for Internet Explorer: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.5.5126.1836\swg.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File

uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"

mRun: [soundMAXPnP] c:\program files\analog devices\soundmax\SMax4PNP.exe

mRun: [soundMAX] "c:\program files\analog devices\soundmax\Smax4.exe" /tray

mRun: [igfxTray] c:\windows\system32\igfxtray.exe

mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe

mRun: [AGRSMMSG] AGRSMMSG.exe

mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe"

mRun: [TFncKy] TFncKy.exe

mRun: [Tvs] c:\program files\toshiba\tvs\TvsTray.exe

mRun: [PAC7302_Monitor] c:\windows\pixart\pac7302\Monitor.exe

mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [ArcSoft Connection Service] c:\program files\common files\arcsoft\connection service\bin\ACDaemon.exe

mRun: [Google Quick Search Box] "c:\program files\google\quick search box\GoogleQuickSearchBox.exe" /autorun

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hppsc2~1.lnk - c:\program files\hewlett-packard\digital imaging\bin\hpobnz08.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpoddt~1.lnk - c:\program files\hewlett-packard\digital imaging\bin\hpotdd01.exe

IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL

DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1279850290022

DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1279850423544

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

DPF: {A9F8D9EC-3D0A-4A60-BD82-FBD64BAD370D} - hxxp://h20264.www2.hp.com/ediags/dd/install/HPDriverDiagnosticsxp2k.cab

DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

TCP: {5A1A5F26-C077-420F-92F4-32B14367C516} = 4.2.2.2,4.2.2.3

TCP: {E3A235BD-B1A4-4EA7-8F44-C6CB28BBF1BC} = 4.2.2.2

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL

Notify: igfxcui - igfxsrvc.dll

============= SERVICES / DRIVERS ===============

R2 ccEvtMgr;Symantec Event Manager;c:\program files\common files\symantec shared\ccSvcHst.exe [2009-7-8 108392]

R2 ccSetMgr;Symantec Settings Manager;c:\program files\common files\symantec shared\ccSvcHst.exe [2009-7-8 108392]

R2 Symantec AntiVirus;Symantec Endpoint Protection;c:\program files\symantec\symantec endpoint protection\Rtvscan.exe [2009-9-17 2477304]

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2010-7-23 102448]

R3 NAVENG;NAVENG;c:\progra~1\common~1\symant~1\virusd~1\20100817.035\NAVENG.SYS [2010-8-17 85424]

R3 NAVEX15;NAVEX15;c:\progra~1\common~1\symant~1\virusd~1\20100817.035\NAVEX15.SYS [2010-8-17 1362608]

S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-8-8 135664]

S3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;c:\windows\system32\drivers\ArcSoftKsUFilter.sys [2010-8-7 14336]

S3 COH_Mon;COH_Mon;c:\windows\system32\drivers\COH_Mon.sys [2009-7-14 23888]

S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [2008-5-6 11520]

=============== Created Last 30 ================

==================== Find3M ====================

2010-07-23 01:00:44 21640 ----a-w- c:\windows\system32\emptyregdb.dat

2010-06-30 12:31:35 149504 ----a-w- c:\windows\system32\schannel.dll

2010-06-24 12:22:03 916480 ----a-w- c:\windows\system32\wininet.dll

2010-06-23 13:44:04 1851904 ----a-w- c:\windows\system32\win32k.sys

2010-06-21 15:27:11 354304 ----a-w- c:\windows\system32\drivers\srv.sys

2010-06-17 14:03:00 80384 ----a-w- c:\windows\system32\iccvid.dll

2010-06-14 07:41:45 1172480 ----a-w- c:\windows\system32\msxml3.dll

============= FINISH: 21:47:27.52 ===============

screen317 · August 18, 2010

Hi,

Please visit this webpage for instructions for running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

When the tool is finished, it will produce a report for you.
Please post the C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system.

-screen317

needafix · August 18, 2010

Hi,
Please visit this webpage for instructions for running ComboFix:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix
When the tool is finished, it will produce a report for you.
Please post the C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system.
-screen317

Here is the ComboFix.txt.

I will now run and post the new DDS log:

ComboFix 10-08-17.04 - Alan 08/18/2010 18:46:36.1.1 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.503.263 [GMT -4:00]

Running from: c:\documents and settings\Alan\Desktop\ComboFix.exe

AV: Symantec Endpoint Protection *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}

FW: Symantec Endpoint Protection *disabled* {BE898FE3-CD0B-4014-85A9-03DB9923DDB6}

.

((((((((((((((((((((((((( Files Created from 2010-07-18 to 2010-08-18 )))))))))))))))))))))))))))))))

.

2010-08-12 21:06 . 2010-08-12 21:06 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache

2010-08-08 23:34 . 2010-08-09 01:29 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP

2010-08-08 23:29 . 2010-08-08 23:29 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater

2010-08-08 13:28 . 2010-08-08 13:28 -------- d-----w- c:\windows\Sun

2010-08-07 23:49 . 1995-07-31 17:44 212480 ----a-w- c:\windows\system32\PCDLIB32.DLL

2010-08-07 23:49 . 2008-04-26 01:06 55808 ----a-w- c:\windows\system32\ArcSoftKsUFilter.dll

2010-08-07 23:49 . 2008-04-26 01:06 14336 ----a-w- c:\windows\system32\drivers\ArcSoftKsUFilter.sys

2010-08-07 23:49 . 2005-04-27 20:36 245408 ----a-w- c:\windows\system32\unicows.dll

2010-08-07 23:32 . 2010-08-07 23:32 -------- d-----w- c:\documents and settings\Alan\Local Settings\Application Data\ArcSoft

2010-08-07 23:32 . 2006-11-10 19:05 18688 ----a-w- c:\windows\system32\drivers\afc.sys

2010-08-07 23:32 . 2010-08-07 23:51 -------- d--h--w- c:\documents and settings\All Users\Application Data\ArcSoft

2010-08-07 23:30 . 2010-08-07 23:49 -------- d-----w- c:\program files\ArcSoft

2010-08-07 23:30 . 2010-08-07 23:32 -------- d-----w- c:\program files\Common Files\ArcSoft

2010-08-07 23:29 . 2010-08-07 23:51 -------- d-----w- c:\documents and settings\Alan\Application Data\ArcSoft

2010-08-06 17:37 . 2010-08-06 17:37 -------- d-----w- c:\program files\Common Files\Java

2010-08-06 17:37 . 2010-08-06 17:37 503808 ----a-w- c:\documents and settings\Alan\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-569b6554-n\msvcp71.dll

2010-08-06 17:37 . 2010-08-06 17:37 499712 ----a-w- c:\documents and settings\Alan\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-569b6554-n\jmc.dll

2010-08-06 17:37 . 2010-08-06 17:37 348160 ----a-w- c:\documents and settings\Alan\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-569b6554-n\msvcr71.dll

2010-08-06 17:37 . 2010-08-06 17:37 61440 ----a-w- c:\documents and settings\Alan\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-406c14ef-n\decora-sse.dll

2010-08-06 17:37 . 2010-08-06 17:37 12800 ----a-w- c:\documents and settings\Alan\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-406c14ef-n\decora-d3d.dll

2010-08-06 17:37 . 2010-08-06 17:36 423656 ----a-w- c:\windows\system32\deployJava1.dll

2010-08-06 17:36 . 2010-08-06 17:36 -------- d-----w- c:\program files\Java

2010-08-04 00:47 . 2010-08-04 00:47 -------- d-----w- c:\documents and settings\Alan\Local Settings\Application Data\Identities

2010-08-03 23:58 . 2010-08-03 23:58 -------- d-----w- c:\windows\system32\LogFiles

2010-07-28 19:44 . 2010-07-28 19:44 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple

2010-07-26 23:34 . 2010-07-26 23:34 -------- d-----w- c:\program files\Rosetta Stone

2010-07-26 23:34 . 2010-07-26 23:34 -------- d--h--w- c:\program files\Zero G Registry

2010-07-26 23:33 . 2010-07-26 23:33 -------- d--h--w- c:\documents and settings\Alan\InstallAnywhere

2010-07-26 00:58 . 2010-07-28 11:47 -------- d-----w- c:\documents and settings\Alan\Local Settings\Application Data\Adobe

2010-07-25 21:20 . 2010-07-25 21:20 -------- d-----w- c:\documents and settings\Alan\Application Data\Hewlett-Packard

2010-07-25 21:15 . 2010-07-25 21:15 -------- d-----w- c:\program files\Common Files\Hewlett-Packard

2010-07-25 21:14 . 2010-07-25 21:15 -------- d-----w- c:\program files\Hewlett-Packard

2010-07-25 21:13 . 2010-07-25 21:17 19558 ----a-w- c:\windows\hpoins01.dat

2010-07-25 21:13 . 2003-04-22 14:24 16606 ------w- c:\windows\hpomdl01.dat

2010-07-25 21:12 . 2010-07-25 21:13 -------- d-----w- c:\temp\HP All-in-One Series Web Release

2010-07-25 21:00 . 2010-07-25 21:17 -------- d-----w- c:\temp\FixEngine

2010-07-25 21:00 . 2010-07-25 21:12 -------- d-----w- C:\temp

2010-07-25 20:58 . 2010-07-25 20:58 10134 ----a-r- c:\documents and settings\Alan\Application Data\Microsoft\Installer\{4CCC7F68-A437-4559-A840-F5E010934951}\ARPPRODUCTICON.exe

2010-07-25 20:58 . 2010-07-25 20:58 -------- d-----w- c:\program files\Hp

2010-07-25 20:58 . 2010-07-25 20:58 -------- d-----w- c:\windows\Downloaded Installations

2010-07-25 20:43 . 2008-04-13 18:47 25856 -c--a-w- c:\windows\system32\dllcache\usbprint.sys

2010-07-25 20:43 . 2008-04-13 18:47 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys

2010-07-25 20:08 . 2010-07-25 20:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Office Genuine Advantage

2010-07-25 20:08 . 2010-07-25 20:08 -------- d-----w- c:\documents and settings\Alan\Application Data\Office Genuine Advantage

2010-07-25 00:40 . 2010-07-25 00:40 230432 ----a-w- C:\PA7302.DAT

2010-07-25 00:28 . 2010-07-25 00:28 38784 ----a-w- c:\documents and settings\Default User\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe

2010-07-25 00:28 . 2010-07-25 00:28 -------- d-----w- c:\program files\Common Files\Adobe AIR

2010-07-25 00:27 . 2010-07-25 00:27 -------- d-----w- c:\documents and settings\Alan\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1

2010-07-25 00:27 . 2010-07-25 00:28 38784 ----a-w- c:\documents and settings\Alan\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe

2010-07-25 00:25 . 2010-07-25 00:25 -------- d-----w- c:\program files\QuickTime

2010-07-25 00:25 . 2010-07-25 00:25 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer

2010-07-25 00:24 . 2010-07-25 00:24 -------- d-----w- c:\program files\Common Files\Apple

2010-07-25 00:24 . 2010-07-25 00:24 -------- d-----w- c:\documents and settings\Alan\Local Settings\Application Data\Apple

2010-07-25 00:24 . 2010-07-25 00:24 -------- d-----w- c:\program files\Apple Software Update

2010-07-25 00:24 . 2010-07-25 00:24 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple

2010-07-25 00:23 . 2010-07-25 00:23 -------- d-----w- c:\documents and settings\Alan\Local Settings\Application Data\Apple Computer

2010-07-25 00:11 . 2010-07-25 00:11 56 ---ha-w- c:\windows\system32\ezsidmv.dat

2010-07-25 00:10 . 2010-08-08 14:48 -------- d-----w- c:\documents and settings\Alan\Application Data\skypePM

2010-07-25 00:07 . 2010-08-08 23:36 -------- d-----w- c:\documents and settings\Alan\Local Settings\Application Data\Temp

2010-07-25 00:07 . 2010-07-25 00:07 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google

2010-07-25 00:02 . 2010-07-25 00:02 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Google

2010-07-25 00:02 . 2010-08-08 15:06 -------- d-----w- c:\documents and settings\Alan\Application Data\Skype

2010-07-25 00:02 . 2010-08-09 01:34 -------- d-----w- c:\documents and settings\Alan\Local Settings\Application Data\Google

2010-07-25 00:01 . 2010-08-08 23:30 -------- d-----w- c:\program files\Google

2010-07-25 00:01 . 2010-07-25 00:01 -------- d-----w- c:\program files\Common Files\Skype

2010-07-25 00:01 . 2010-07-25 00:01 -------- d-----r- c:\program files\Skype

2010-07-25 00:00 . 2010-07-25 00:00 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype

2010-07-24 23:17 . 2008-04-13 18:39 5504 -c--a-w- c:\windows\system32\dllcache\mstee.sys

2010-07-24 23:17 . 2008-04-13 18:39 5504 ----a-w- c:\windows\system32\drivers\MSTEE.sys

2010-07-24 23:17 . 2008-04-13 18:46 10880 -c--a-w- c:\windows\system32\dllcache\ndisip.sys

2010-07-24 23:17 . 2008-04-13 18:46 10880 ----a-w- c:\windows\system32\drivers\NdisIP.sys

2010-07-24 23:17 . 2008-04-13 18:46 15232 -c--a-w- c:\windows\system32\dllcache\streamip.sys

2010-07-24 23:17 . 2008-04-13 18:46 15232 ----a-w- c:\windows\system32\drivers\StreamIP.sys

2010-07-24 23:17 . 2008-04-13 18:46 11136 -c--a-w- c:\windows\system32\dllcache\slip.sys

2010-07-24 23:17 . 2008-04-13 18:46 11136 ----a-w- c:\windows\system32\drivers\SLIP.sys

2010-07-24 23:17 . 2008-04-13 18:46 19200 -c--a-w- c:\windows\system32\dllcache\wstcodec.sys

2010-07-24 23:17 . 2008-04-13 18:46 19200 ----a-w- c:\windows\system32\drivers\WSTCODEC.SYS

2010-07-24 23:16 . 2008-04-13 18:46 85248 -c--a-w- c:\windows\system32\dllcache\nabtsfec.sys

2010-07-24 23:16 . 2008-04-13 18:46 85248 ----a-w- c:\windows\system32\drivers\NABTSFEC.sys

2010-07-24 23:16 . 2008-04-13 18:46 17024 -c--a-w- c:\windows\system32\dllcache\ccdecode.sys

2010-07-24 23:16 . 2008-04-13 18:46 17024 ----a-w- c:\windows\system32\drivers\CCDECODE.sys

2010-07-24 23:16 . 2008-04-14 00:12 53760 -c--a-w- c:\windows\system32\dllcache\vfwwdm32.dll

2010-07-24 23:16 . 2008-04-14 00:12 53760 ----a-w- c:\windows\system32\vfwwdm32.dll

2010-07-24 22:59 . 2010-07-28 11:49 -------- d-----w- c:\program files\Common Files\Adobe

2010-07-24 22:57 . 2006-11-03 14:59 48128 ------w- c:\windows\system32\Remove.exe

2010-07-24 22:57 . 2007-09-10 12:50 457984 ----a-w- c:\windows\system32\drivers\PAC7302.SYS

2010-07-24 22:57 . 2007-09-05 21:01 6656 ----a-w- c:\windows\system32\CoInst_070910.dll

2010-07-24 22:57 . 2010-07-24 22:57 -------- d-----w- c:\program files\Aecotech

2010-07-24 22:57 . 2006-10-12 15:57 14336 ----a-w- c:\windows\system32\P7302USD.dll

2010-07-24 22:57 . 2010-07-24 22:57 -------- d-----w- c:\program files\Common Files\PAC7302

2010-07-24 22:57 . 2010-07-24 22:57 -------- d-----w- c:\windows\PixArt

2010-07-24 22:57 . 2010-07-24 22:57 -------- d-----w- c:\documents and settings\Alan\Application Data\InstallShield

2010-07-24 22:56 . 2008-04-13 18:45 60032 -c--a-w- c:\windows\system32\dllcache\usbaudio.sys

2010-07-24 22:56 . 2008-04-13 18:45 60032 ----a-w- c:\windows\system32\drivers\USBAUDIO.sys

2010-07-24 22:53 . 2008-04-13 18:45 32128 -c--a-w- c:\windows\system32\dllcache\usbccgp.sys

2010-07-24 22:53 . 2008-04-13 18:45 32128 ----a-w- c:\windows\system32\drivers\usbccgp.sys

2010-07-24 22:42 . 2010-07-24 22:42 -------- d-----w- c:\documents and settings\Alan\Application Data\Malwarebytes

2010-07-24 22:41 . 2010-04-29 19:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-07-24 22:41 . 2010-07-24 22:41 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2010-07-24 22:41 . 2010-04-29 19:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-07-24 22:41 . 2010-07-24 22:42 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-07-24 04:21 . 2010-07-24 04:21 -------- d-sh--w- c:\documents and settings\Alan\IECompatCache

2010-07-24 03:30 . 2010-07-24 03:30 2605008 ----a-w- c:\documents and settings\Alan\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe

2010-07-24 02:47 . 2007-04-09 17:23 28552 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\mdippr.dll

2010-07-24 02:47 . 2007-04-09 17:23 28040 ----a-w- c:\windows\system32\mdimon.dll

2010-07-24 02:46 . 2010-07-24 02:46 -------- d-----w- c:\program files\Common Files\L&H

2010-07-24 02:45 . 2010-07-24 02:45 -------- d-----w- c:\program files\Microsoft.NET

2010-07-24 02:45 . 2010-07-24 02:45 -------- d-----w- c:\program files\Microsoft ActiveSync

2010-07-24 02:45 . 2010-07-24 23:18 -------- d-----w- c:\program files\Microsoft Works

2010-07-24 02:44 . 2010-07-24 02:45 -------- d-----w- c:\windows\SHELLNEW

2010-07-24 02:38 . 2010-07-24 02:38 -------- d-sh--w- c:\documents and settings\Alexander\PrivacIE

2010-07-24 01:32 . 2004-11-12 21:57 49664 ----a-w- c:\windows\system32\TvsCtrl.dll

2010-07-24 01:32 . 2004-11-12 21:57 29056 ----a-w- c:\windows\system32\drivers\Tvs.sys

2010-07-24 01:32 . 2004-07-28 18:26 29184 ----a-w- c:\windows\system32\drivers\TSXT_kern_i386.sys

2010-07-24 01:32 . 2004-05-21 13:16 28032 ----a-w- c:\windows\system32\drivers\WOWXT_kern_i386.sys

2010-07-24 01:32 . 2010-07-24 01:32 -------- d-----w- C:\Virtual Sound.temp

2010-07-24 01:30 . 2004-09-07 21:35 102400 ----a-w- c:\windows\system32\TCtrlCommon.dll

2010-07-24 01:30 . 2010-07-24 01:30 -------- d-----w- C:\Controls.temp

2010-07-24 01:29 . 2010-07-24 01:32 -------- d-----w- c:\program files\Toshiba

2010-07-24 01:29 . 2003-06-11 12:53 6867 ----a-w- c:\windows\system32\drivers\tbiosdrv.sys

2010-07-24 01:29 . 2001-10-18 14:39 90112 ------w- c:\windows\InstDrvr.exe

2010-07-24 01:28 . 1998-10-29 19:45 306688 ----a-w- c:\windows\IsUninst.exe

2010-07-24 01:28 . 2010-07-24 01:28 -------- d-----w- c:\documents and settings\Alan\WINDOWS

2010-07-24 01:12 . 2010-07-24 01:12 -------- d-----w- c:\documents and settings\Alan\Local Settings\Application Data\Symantec

2010-07-24 01:12 . 2010-06-02 23:59 161920 ----a-w- c:\windows\system32\drivers\wpshelper.sys

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-08-07 23:49 . 2010-07-23 01:30 -------- d--h--w- c:\program files\InstallShield Installation Information

2010-07-24 02:40 . 2010-07-24 02:40 13104 ----a-w- c:\documents and settings\Catalina\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2010-07-24 02:38 . 2010-07-24 02:38 13104 ----a-w- c:\documents and settings\Alexander\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2010-07-24 01:10 . 2010-07-24 01:10 806 ----a-w- c:\windows\system32\drivers\SYMEVENT.INF

2010-07-24 01:10 . 2010-07-24 01:10 7456 ----a-w- c:\windows\system32\drivers\SYMEVENT.CAT

2010-07-24 01:01 . 2010-07-23 01:30 -------- d-----w- c:\program files\Common Files\InstallShield

2010-07-23 04:40 . 2010-07-23 01:03 86327 ----a-w- c:\windows\PCHEALTH\HELPCTR\OfflineCache\index.dat

2010-07-23 01:30 . 2010-07-23 01:30 -------- d-----w- c:\program files\Analog Devices

2010-07-23 01:25 . 2010-07-23 01:25 -------- d-----w- c:\program files\Intel

2010-07-23 01:04 . 2010-07-23 01:04 -------- d-----w- c:\program files\microsoft frontpage

2010-07-23 01:00 . 2010-07-23 01:00 21640 ----a-w- c:\windows\system32\emptyregdb.dat

2010-06-30 12:31 . 2001-08-23 12:00 149504 ----a-w- c:\windows\system32\schannel.dll

2010-06-24 12:22 . 2001-08-23 12:00 916480 ----a-w- c:\windows\system32\wininet.dll

2010-06-23 13:44 . 2001-08-23 12:00 1851904 ----a-w- c:\windows\system32\win32k.sys

2010-06-21 15:27 . 2001-08-23 12:00 354304 ----a-w- c:\windows\system32\drivers\srv.sys

2010-06-17 14:03 . 2001-08-23 12:00 80384 ----a-w- c:\windows\system32\iccvid.dll

2010-06-14 14:31 . 2010-07-23 01:01 744448 ----a-w- c:\windows\PCHEALTH\HELPCTR\Binaries\helpsvc.exe

2010-06-14 07:41 . 2001-08-23 12:00 1172480 ----a-w- c:\windows\system32\msxml3.dll

2010-06-09 08:06 . 2010-06-09 08:06 976832 ----a-w- c:\documents and settings\All Users\Application Data\Adobe\Reader\9.2\ARM\ARM Update\AdobeARM.exe

2010-06-09 08:06 . 2010-06-09 08:06 70584 ----a-w- c:\documents and settings\All Users\Application Data\Adobe\Reader\9.2\ARM\ARM Update\AdobeExtractFiles.dll

2010-06-09 08:06 . 2010-06-09 08:06 331176 ----a-w- c:\documents and settings\All Users\Application Data\Adobe\Reader\9.2\ARM\ARM Update\ReaderUpdater.exe

2010-06-09 08:06 . 2010-06-09 08:06 331176 ----a-w- c:\documents and settings\All Users\Application Data\Adobe\Reader\9.2\ARM\ARM Update\AcrobatUpdater.exe

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-08-08 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-07-27 1388544]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-10-08 155648]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-10-08 126976]

"AGRSMMSG"="AGRSMMSG.exe" [2004-10-28 88363]

"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2009-07-09 115560]

"TFncKy"="TFncKy.exe" [bU]

"Tvs"="c:\program files\Toshiba\Tvs\TvsTray.exe" [2004-11-12 73728]

"PAC7302_Monitor"="c:\windows\PixArt\PAC7302\Monitor.exe" [2006-11-03 319488]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-18 421888]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-03-18 207360]

"Google Quick Search Box"="c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe" [2010-08-08 126976]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

hp psc 2000 Series.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe [2003-4-9 323646]

hpoddt01.exe.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2003-4-9 28672]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccEvtMgr]

@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccSetMgr]

@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Symantec Antivirus]

@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Symantec\\Symantec Endpoint Protection\\Smc.exe"=

"c:\\Program Files\\Symantec\\Symantec Endpoint Protection\\SNAC.EXE"=

"c:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe"=

"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [7/23/2010 9:32 PM 102448]

S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [8/8/2010 7:30 PM 135664]

S3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;c:\windows\system32\drivers\ArcSoftKsUFilter.sys [8/7/2010 7:49 PM 14336]

S3 COH_Mon;COH_Mon;c:\windows\system32\drivers\COH_Mon.sys [7/14/2009 12:51 PM 23888]

S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [5/6/2008 4:06 PM 11520]

.

Contents of the 'Scheduled Tasks' folder

2010-08-18 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]

2010-08-09 c:\windows\Tasks\FRU Task 2003-04-10 00:56ewlett-Packard2003-04-10 00:56p psc 2200 series272A572217594EBCF1CEE215E352B92AD073FDE4280092755.job

- c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-09 21:56]

2010-08-18 c:\windows\Tasks\Google Software Updater.job

- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2010-08-08 23:29]

2010-08-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-08-08 23:30]

2010-08-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-08-08 23:30]

2010-08-17 c:\windows\Tasks\OGALogon.job

- c:\windows\system32\OGAEXEC.exe [2009-08-03 19:07]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://co114w.col114.mail.live.com/default.aspx?wa=wsignin1.0

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html

TCP: {5A1A5F26-C077-420F-92F4-32B14367C516} = 4.2.2.2,4.2.2.3

TCP: {E3A235BD-B1A4-4EA7-8F44-C6CB28BBF1BC} = 4.2.2.2

.

- - - - ORPHANS REMOVED - - - -

SafeBoot-Symantec Antvirus

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-08-18 18:52

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(832)

c:\windows\system32\WININET.dll

c:\program files\Google\Quick Search Box\bin\1.2.1151.245\qsb.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\webcheck.dll

.

Completion time: 2010-08-18 18:54:50

ComboFix-quarantined-files.txt 2010-08-18 22:54

Pre-Run: 18,362,101,760 bytes free

Post-Run: 18,578,403,328 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

- - End Of File - - 02A59622192E8DD750DF9E50DE5FA520

needafix · August 18, 2010

Here is the ComboFix.txt.
I will now run and post the new DDS log:
ComboFix 10-08-17.04 - Alan 08/18/2010 18:46:36.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.503.263 [GMT -4:00]
Running from: c:\documents and settings\Alan\Desktop\ComboFix.exe
AV: Symantec Endpoint Protection *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}
FW: Symantec Endpoint Protection *disabled* {BE898FE3-CD0B-4014-85A9-03DB9923DDB6}
.
((((((((((((((((((((((((( Files Created from 2010-07-18 to 2010-08-18 )))))))))))))))))))))))))))))))
.
2010-08-12 21:06 . 2010-08-12 21:06 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2010-08-08 23:34 . 2010-08-09 01:29 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-08-08 23:29 . 2010-08-08 23:29 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2010-08-08 13:28 . 2010-08-08 13:28 -------- d-----w- c:\windows\Sun
2010-08-07 23:49 . 1995-07-31 17:44 212480 ----a-w- c:\windows\system32\PCDLIB32.DLL
2010-08-07 23:49 . 2008-04-26 01:06 55808 ----a-w- c:\windows\system32\ArcSoftKsUFilter.dll
2010-08-07 23:49 . 2008-04-26 01:06 14336 ----a-w- c:\windows\system32\drivers\ArcSoftKsUFilter.sys
2010-08-07 23:49 . 2005-04-27 20:36 245408 ----a-w- c:\windows\system32\unicows.dll
2010-08-07 23:32 . 2010-08-07 23:32 -------- d-----w- c:\documents and settings\Alan\Local Settings\Application Data\ArcSoft
2010-08-07 23:32 . 2006-11-10 19:05 18688 ----a-w- c:\windows\system32\drivers\afc.sys
2010-08-07 23:32 . 2010-08-07 23:51 -------- d--h--w- c:\documents and settings\All Users\Application Data\ArcSoft
2010-08-07 23:30 . 2010-08-07 23:49 -------- d-----w- c:\program files\ArcSoft
2010-08-07 23:30 . 2010-08-07 23:32 -------- d-----w- c:\program files\Common Files\ArcSoft
2010-08-07 23:29 . 2010-08-07 23:51 -------- d-----w- c:\documents and settings\Alan\Application Data\ArcSoft
2010-08-06 17:37 . 2010-08-06 17:37 -------- d-----w- c:\program files\Common Files\Java
2010-08-06 17:37 . 2010-08-06 17:37 503808 ----a-w- c:\documents and settings\Alan\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-569b6554-n\msvcp71.dll
2010-08-06 17:37 . 2010-08-06 17:37 499712 ----a-w- c:\documents and settings\Alan\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-569b6554-n\jmc.dll
2010-08-06 17:37 . 2010-08-06 17:37 348160 ----a-w- c:\documents and settings\Alan\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-569b6554-n\msvcr71.dll
2010-08-06 17:37 . 2010-08-06 17:37 61440 ----a-w- c:\documents and settings\Alan\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-406c14ef-n\decora-sse.dll
2010-08-06 17:37 . 2010-08-06 17:37 12800 ----a-w- c:\documents and settings\Alan\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-406c14ef-n\decora-d3d.dll
2010-08-06 17:37 . 2010-08-06 17:36 423656 ----a-w- c:\windows\system32\deployJava1.dll
2010-08-06 17:36 . 2010-08-06 17:36 -------- d-----w- c:\program files\Java
2010-08-04 00:47 . 2010-08-04 00:47 -------- d-----w- c:\documents and settings\Alan\Local Settings\Application Data\Identities
2010-08-03 23:58 . 2010-08-03 23:58 -------- d-----w- c:\windows\system32\LogFiles
2010-07-28 19:44 . 2010-07-28 19:44 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple
2010-07-26 23:34 . 2010-07-26 23:34 -------- d-----w- c:\program files\Rosetta Stone
2010-07-26 23:34 . 2010-07-26 23:34 -------- d--h--w- c:\program files\Zero G Registry
2010-07-26 23:33 . 2010-07-26 23:33 -------- d--h--w- c:\documents and settings\Alan\InstallAnywhere
2010-07-26 00:58 . 2010-07-28 11:47 -------- d-----w- c:\documents and settings\Alan\Local Settings\Application Data\Adobe
2010-07-25 21:20 . 2010-07-25 21:20 -------- d-----w- c:\documents and settings\Alan\Application Data\Hewlett-Packard
2010-07-25 21:15 . 2010-07-25 21:15 -------- d-----w- c:\program files\Common Files\Hewlett-Packard
2010-07-25 21:14 . 2010-07-25 21:15 -------- d-----w- c:\program files\Hewlett-Packard
2010-07-25 21:13 . 2010-07-25 21:17 19558 ----a-w- c:\windows\hpoins01.dat
2010-07-25 21:13 . 2003-04-22 14:24 16606 ------w- c:\windows\hpomdl01.dat
2010-07-25 21:12 . 2010-07-25 21:13 -------- d-----w- c:\temp\HP All-in-One Series Web Release
2010-07-25 21:00 . 2010-07-25 21:17 -------- d-----w- c:\temp\FixEngine
2010-07-25 21:00 . 2010-07-25 21:12 -------- d-----w- C:\temp
2010-07-25 20:58 . 2010-07-25 20:58 10134 ----a-r- c:\documents and settings\Alan\Application Data\Microsoft\Installer\{4CCC7F68-A437-4559-A840-F5E010934951}\ARPPRODUCTICON.exe
2010-07-25 20:58 . 2010-07-25 20:58 -------- d-----w- c:\program files\Hp
2010-07-25 20:58 . 2010-07-25 20:58 -------- d-----w- c:\windows\Downloaded Installations
2010-07-25 20:43 . 2008-04-13 18:47 25856 -c--a-w- c:\windows\system32\dllcache\usbprint.sys
2010-07-25 20:43 . 2008-04-13 18:47 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys
2010-07-25 20:08 . 2010-07-25 20:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2010-07-25 20:08 . 2010-07-25 20:08 -------- d-----w- c:\documents and settings\Alan\Application Data\Office Genuine Advantage
2010-07-25 00:40 . 2010-07-25 00:40 230432 ----a-w- C:\PA7302.DAT
2010-07-25 00:28 . 2010-07-25 00:28 38784 ----a-w- c:\documents and settings\Default User\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-07-25 00:28 . 2010-07-25 00:28 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-07-25 00:27 . 2010-07-25 00:27 -------- d-----w- c:\documents and settings\Alan\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2010-07-25 00:27 . 2010-07-25 00:28 38784 ----a-w- c:\documents and settings\Alan\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-07-25 00:25 . 2010-07-25 00:25 -------- d-----w- c:\program files\QuickTime
2010-07-25 00:25 . 2010-07-25 00:25 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2010-07-25 00:24 . 2010-07-25 00:24 -------- d-----w- c:\program files\Common Files\Apple
2010-07-25 00:24 . 2010-07-25 00:24 -------- d-----w- c:\documents and settings\Alan\Local Settings\Application Data\Apple
2010-07-25 00:24 . 2010-07-25 00:24 -------- d-----w- c:\program files\Apple Software Update
2010-07-25 00:24 . 2010-07-25 00:24 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
2010-07-25 00:23 . 2010-07-25 00:23 -------- d-----w- c:\documents and settings\Alan\Local Settings\Application Data\Apple Computer
2010-07-25 00:11 . 2010-07-25 00:11 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2010-07-25 00:10 . 2010-08-08 14:48 -------- d-----w- c:\documents and settings\Alan\Application Data\skypePM
2010-07-25 00:07 . 2010-08-08 23:36 -------- d-----w- c:\documents and settings\Alan\Local Settings\Application Data\Temp
2010-07-25 00:07 . 2010-07-25 00:07 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2010-07-25 00:02 . 2010-07-25 00:02 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Google
2010-07-25 00:02 . 2010-08-08 15:06 -------- d-----w- c:\documents and settings\Alan\Application Data\Skype
2010-07-25 00:02 . 2010-08-09 01:34 -------- d-----w- c:\documents and settings\Alan\Local Settings\Application Data\Google
2010-07-25 00:01 . 2010-08-08 23:30 -------- d-----w- c:\program files\Google
2010-07-25 00:01 . 2010-07-25 00:01 -------- d-----w- c:\program files\Common Files\Skype
2010-07-25 00:01 . 2010-07-25 00:01 -------- d-----r- c:\program files\Skype
2010-07-25 00:00 . 2010-07-25 00:00 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2010-07-24 23:17 . 2008-04-13 18:39 5504 -c--a-w- c:\windows\system32\dllcache\mstee.sys
2010-07-24 23:17 . 2008-04-13 18:39 5504 ----a-w- c:\windows\system32\drivers\MSTEE.sys
2010-07-24 23:17 . 2008-04-13 18:46 10880 -c--a-w- c:\windows\system32\dllcache\ndisip.sys
2010-07-24 23:17 . 2008-04-13 18:46 10880 ----a-w- c:\windows\system32\drivers\NdisIP.sys
2010-07-24 23:17 . 2008-04-13 18:46 15232 -c--a-w- c:\windows\system32\dllcache\streamip.sys
2010-07-24 23:17 . 2008-04-13 18:46 15232 ----a-w- c:\windows\system32\drivers\StreamIP.sys
2010-07-24 23:17 . 2008-04-13 18:46 11136 -c--a-w- c:\windows\system32\dllcache\slip.sys
2010-07-24 23:17 . 2008-04-13 18:46 11136 ----a-w- c:\windows\system32\drivers\SLIP.sys
2010-07-24 23:17 . 2008-04-13 18:46 19200 -c--a-w- c:\windows\system32\dllcache\wstcodec.sys
2010-07-24 23:17 . 2008-04-13 18:46 19200 ----a-w- c:\windows\system32\drivers\WSTCODEC.SYS
2010-07-24 23:16 . 2008-04-13 18:46 85248 -c--a-w- c:\windows\system32\dllcache\nabtsfec.sys
2010-07-24 23:16 . 2008-04-13 18:46 85248 ----a-w- c:\windows\system32\drivers\NABTSFEC.sys
2010-07-24 23:16 . 2008-04-13 18:46 17024 -c--a-w- c:\windows\system32\dllcache\ccdecode.sys
2010-07-24 23:16 . 2008-04-13 18:46 17024 ----a-w- c:\windows\system32\drivers\CCDECODE.sys
2010-07-24 23:16 . 2008-04-14 00:12 53760 -c--a-w- c:\windows\system32\dllcache\vfwwdm32.dll
2010-07-24 23:16 . 2008-04-14 00:12 53760 ----a-w- c:\windows\system32\vfwwdm32.dll
2010-07-24 22:59 . 2010-07-28 11:49 -------- d-----w- c:\program files\Common Files\Adobe
2010-07-24 22:57 . 2006-11-03 14:59 48128 ------w- c:\windows\system32\Remove.exe
2010-07-24 22:57 . 2007-09-10 12:50 457984 ----a-w- c:\windows\system32\drivers\PAC7302.SYS
2010-07-24 22:57 . 2007-09-05 21:01 6656 ----a-w- c:\windows\system32\CoInst_070910.dll
2010-07-24 22:57 . 2010-07-24 22:57 -------- d-----w- c:\program files\Aecotech
2010-07-24 22:57 . 2006-10-12 15:57 14336 ----a-w- c:\windows\system32\P7302USD.dll
2010-07-24 22:57 . 2010-07-24 22:57 -------- d-----w- c:\program files\Common Files\PAC7302
2010-07-24 22:57 . 2010-07-24 22:57 -------- d-----w- c:\windows\PixArt
2010-07-24 22:57 . 2010-07-24 22:57 -------- d-----w- c:\documents and settings\Alan\Application Data\InstallShield
2010-07-24 22:56 . 2008-04-13 18:45 60032 -c--a-w- c:\windows\system32\dllcache\usbaudio.sys
2010-07-24 22:56 . 2008-04-13 18:45 60032 ----a-w- c:\windows\system32\drivers\USBAUDIO.sys
2010-07-24 22:53 . 2008-04-13 18:45 32128 -c--a-w- c:\windows\system32\dllcache\usbccgp.sys
2010-07-24 22:53 . 2008-04-13 18:45 32128 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2010-07-24 22:42 . 2010-07-24 22:42 -------- d-----w- c:\documents and settings\Alan\Application Data\Malwarebytes
2010-07-24 22:41 . 2010-04-29 19:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-07-24 22:41 . 2010-07-24 22:41 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-07-24 22:41 . 2010-04-29 19:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-07-24 22:41 . 2010-07-24 22:42 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-07-24 04:21 . 2010-07-24 04:21 -------- d-sh--w- c:\documents and settings\Alan\IECompatCache
2010-07-24 03:30 . 2010-07-24 03:30 2605008 ----a-w- c:\documents and settings\Alan\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe
2010-07-24 02:47 . 2007-04-09 17:23 28552 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\mdippr.dll
2010-07-24 02:47 . 2007-04-09 17:23 28040 ----a-w- c:\windows\system32\mdimon.dll
2010-07-24 02:46 . 2010-07-24 02:46 -------- d-----w- c:\program files\Common Files\L&H
2010-07-24 02:45 . 2010-07-24 02:45 -------- d-----w- c:\program files\Microsoft.NET
2010-07-24 02:45 . 2010-07-24 02:45 -------- d-----w- c:\program files\Microsoft ActiveSync
2010-07-24 02:45 . 2010-07-24 23:18 -------- d-----w- c:\program files\Microsoft Works
2010-07-24 02:44 . 2010-07-24 02:45 -------- d-----w- c:\windows\SHELLNEW
2010-07-24 02:38 . 2010-07-24 02:38 -------- d-sh--w- c:\documents and settings\Alexander\PrivacIE
2010-07-24 01:32 . 2004-11-12 21:57 49664 ----a-w- c:\windows\system32\TvsCtrl.dll
2010-07-24 01:32 . 2004-11-12 21:57 29056 ----a-w- c:\windows\system32\drivers\Tvs.sys
2010-07-24 01:32 . 2004-07-28 18:26 29184 ----a-w- c:\windows\system32\drivers\TSXT_kern_i386.sys
2010-07-24 01:32 . 2004-05-21 13:16 28032 ----a-w- c:\windows\system32\drivers\WOWXT_kern_i386.sys
2010-07-24 01:32 . 2010-07-24 01:32 -------- d-----w- C:\Virtual Sound.temp
2010-07-24 01:30 . 2004-09-07 21:35 102400 ----a-w- c:\windows\system32\TCtrlCommon.dll
2010-07-24 01:30 . 2010-07-24 01:30 -------- d-----w- C:\Controls.temp
2010-07-24 01:29 . 2010-07-24 01:32 -------- d-----w- c:\program files\Toshiba
2010-07-24 01:29 . 2003-06-11 12:53 6867 ----a-w- c:\windows\system32\drivers\tbiosdrv.sys
2010-07-24 01:29 . 2001-10-18 14:39 90112 ------w- c:\windows\InstDrvr.exe
2010-07-24 01:28 . 1998-10-29 19:45 306688 ----a-w- c:\windows\IsUninst.exe
2010-07-24 01:28 . 2010-07-24 01:28 -------- d-----w- c:\documents and settings\Alan\WINDOWS
2010-07-24 01:12 . 2010-07-24 01:12 -------- d-----w- c:\documents and settings\Alan\Local Settings\Application Data\Symantec
2010-07-24 01:12 . 2010-06-02 23:59 161920 ----a-w- c:\windows\system32\drivers\wpshelper.sys
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-07 23:49 . 2010-07-23 01:30 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-07-24 02:40 . 2010-07-24 02:40 13104 ----a-w- c:\documents and settings\Catalina\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-07-24 02:38 . 2010-07-24 02:38 13104 ----a-w- c:\documents and settings\Alexander\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-07-24 01:10 . 2010-07-24 01:10 806 ----a-w- c:\windows\system32\drivers\SYMEVENT.INF
2010-07-24 01:10 . 2010-07-24 01:10 7456 ----a-w- c:\windows\system32\drivers\SYMEVENT.CAT
2010-07-24 01:01 . 2010-07-23 01:30 -------- d-----w- c:\program files\Common Files\InstallShield
2010-07-23 04:40 . 2010-07-23 01:03 86327 ----a-w- c:\windows\PCHEALTH\HELPCTR\OfflineCache\index.dat
2010-07-23 01:30 . 2010-07-23 01:30 -------- d-----w- c:\program files\Analog Devices
2010-07-23 01:25 . 2010-07-23 01:25 -------- d-----w- c:\program files\Intel
2010-07-23 01:04 . 2010-07-23 01:04 -------- d-----w- c:\program files\microsoft frontpage
2010-07-23 01:00 . 2010-07-23 01:00 21640 ----a-w- c:\windows\system32\emptyregdb.dat
2010-06-30 12:31 . 2001-08-23 12:00 149504 ----a-w- c:\windows\system32\schannel.dll
2010-06-24 12:22 . 2001-08-23 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2010-06-23 13:44 . 2001-08-23 12:00 1851904 ----a-w- c:\windows\system32\win32k.sys
2010-06-21 15:27 . 2001-08-23 12:00 354304 ----a-w- c:\windows\system32\drivers\srv.sys
2010-06-17 14:03 . 2001-08-23 12:00 80384 ----a-w- c:\windows\system32\iccvid.dll
2010-06-14 14:31 . 2010-07-23 01:01 744448 ----a-w- c:\windows\PCHEALTH\HELPCTR\Binaries\helpsvc.exe
2010-06-14 07:41 . 2001-08-23 12:00 1172480 ----a-w- c:\windows\system32\msxml3.dll
2010-06-09 08:06 . 2010-06-09 08:06 976832 ----a-w- c:\documents and settings\All Users\Application Data\Adobe\Reader\9.2\ARM\ARM Update\AdobeARM.exe
2010-06-09 08:06 . 2010-06-09 08:06 70584 ----a-w- c:\documents and settings\All Users\Application Data\Adobe\Reader\9.2\ARM\ARM Update\AdobeExtractFiles.dll
2010-06-09 08:06 . 2010-06-09 08:06 331176 ----a-w- c:\documents and settings\All Users\Application Data\Adobe\Reader\9.2\ARM\ARM Update\ReaderUpdater.exe
2010-06-09 08:06 . 2010-06-09 08:06 331176 ----a-w- c:\documents and settings\All Users\Application Data\Adobe\Reader\9.2\ARM\ARM Update\AcrobatUpdater.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-08-08 39408]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-07-27 1388544]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-10-08 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-10-08 126976]
"AGRSMMSG"="AGRSMMSG.exe" [2004-10-28 88363]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2009-07-09 115560]
"TFncKy"="TFncKy.exe" [bU]
"Tvs"="c:\program files\Toshiba\Tvs\TvsTray.exe" [2004-11-12 73728]
"PAC7302_Monitor"="c:\windows\PixArt\PAC7302\Monitor.exe" [2006-11-03 319488]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-18 421888]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-03-18 207360]
"Google Quick Search Box"="c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe" [2010-08-08 126976]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
hp psc 2000 Series.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe [2003-4-9 323646]
hpoddt01.exe.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2003-4-9 28672]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccEvtMgr]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccSetMgr]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Symantec Antivirus]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Symantec\\Symantec Endpoint Protection\\Smc.exe"=
"c:\\Program Files\\Symantec\\Symantec Endpoint Protection\\SNAC.EXE"=
"c:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [7/23/2010 9:32 PM 102448]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [8/8/2010 7:30 PM 135664]
S3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;c:\windows\system32\drivers\ArcSoftKsUFilter.sys [8/7/2010 7:49 PM 14336]
S3 COH_Mon;COH_Mon;c:\windows\system32\drivers\COH_Mon.sys [7/14/2009 12:51 PM 23888]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [5/6/2008 4:06 PM 11520]
.
Contents of the 'Scheduled Tasks' folder
2010-08-18 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]
2010-08-09 c:\windows\Tasks\FRU Task 2003-04-10 00:56ewlett-Packard2003-04-10 00:56p psc 2200 series272A572217594EBCF1CEE215E352B92AD073FDE4280092755.job
- c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-09 21:56]
2010-08-18 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2010-08-08 23:29]
2010-08-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-08-08 23:30]
2010-08-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-08-08 23:30]
2010-08-17 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAEXEC.exe [2009-08-03 19:07]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://co114w.col114.mail.live.com/default.aspx?wa=wsignin1.0
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
TCP: {5A1A5F26-C077-420F-92F4-32B14367C516} = 4.2.2.2,4.2.2.3
TCP: {E3A235BD-B1A4-4EA7-8F44-C6CB28BBF1BC} = 4.2.2.2
.
- - - - ORPHANS REMOVED - - - -
SafeBoot-Symantec Antvirus
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-08-18 18:52
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'explorer.exe'(832)
c:\windows\system32\WININET.dll
c:\program files\Google\Quick Search Box\bin\1.2.1151.245\qsb.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
Completion time: 2010-08-18 18:54:50
ComboFix-quarantined-files.txt 2010-08-18 22:54
Pre-Run: 18,362,101,760 bytes free
Post-Run: 18,578,403,328 bytes free
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn
- - End Of File - - 02A59622192E8DD750DF9E50DE5FA520

And here is the new DDS log:

DDS (Ver_10-03-17.01) - NTFSx86

Run by Alan at 19:00:56.40 on Wed 08/18/2010

Internet Explorer: 8.0.6001.18702

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.503.83 [GMT -4:00]

AV: Symantec Endpoint Protection *On-access scanning enabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}

FW: Symantec Endpoint Protection *enabled* {BE898FE3-CD0B-4014-85A9-03DB9923DDB6}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe

svchost.exe

C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

C:\WINDOWS\System32\svchost.exe -k imgsvc

C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe

C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe

C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\AGRSMMSG.exe

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\Program Files\Toshiba\Tvs\TvsTray.exe

C:\WINDOWS\PixArt\PAC7302\Monitor.exe

C:\WINDOWS\System32\svchost.exe -k HTTPFilter

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe

C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe

C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe

C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe

C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe

C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\notepad.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Documents and Settings\Alan\Desktop\dds.scr

C:\Program Files\Skype\Toolbars\Shared\SkypeNames2.exe