I'm infected, please help

Msmich1 · August 27, 2010

I ran Norton and Malwarebytes with no luck. Here is a copy of malwarebytes scan and DDs file....

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4478

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

8/25/2010 4:53:49 PM

mbam-log-2010-08-25 (16-53-49).txt

Scan type: Full scan (C:\|D:\|)

Objects scanned: 273344

Time elapsed: 1 hour(s), 15 minute(s), 23 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

DDS (Ver_10-03-17.01) - NTFSx86

Run by HP_Owner at 18:07:26.46 on Thu 08/26/2010

Internet Explorer: 7.0.5730.13

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.447.114 [GMT -5:00]

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\Common Files\AOL\1225423384\ee\AOLSoftware.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe

C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe

C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

svchost.exe

C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\system32\svchost.exe -k hpdevmgmt

C:\WINDOWS\system32\svchost.exe -k HPService

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Kodak\printer\center\KodakSvc.exe

C:\WINDOWS\System32\svchost.exe -k HPZ12

C:\Program Files\Norton Internet Security\Engine\16.8.0.41\ccSvcHst.exe

C:\WINDOWS\System32\svchost.exe -k HPZ12

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Program Files\Norton Internet Security\Engine\16.8.0.41\ccSvcHst.exe

C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe

C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe

C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe

C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

c:\windows\system\hpsysdrv.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\AOL 9.5\waol.exe

C:\Program Files\AOL 9.5\shellmon.exe

C:\Program Files\Common Files\AOL\Topspeed\3.0\aoltpsd3.exe

C:\Documents and Settings\HP_Owner\Desktop\dds.scr

============== Pseudo HJT Report ===============

uSearch Bar = hxxp://www.google.com/ie

uSearchMigratedDefaultURL = hxxp://search.aol.com/aolcom/search?query={searchTerms}&invocationType=msie70a

uInternet Settings,ProxyOverride = *.local

uSearchURL,(Default) = hxxp://search.alot.com/web?q=&pr=auto&client_id=017B7BE001CAB9A60349301D&src_id=20001&camp_id=848&tb_version=2.5.9000.490

mURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -

mWinlogon: Userinit=c:\windows\system32\userinit.exe

BHO: ALOT Toolbar Helper: {14ceeaff-96dd-4101-ae37-d5ecdc23c3f6} - c:\program files\alot\bin\alot.dll

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: AOL Toolbar Loader: {3ef64538-8b54-4573-b48f-4d34b0238ab2} - c:\program files\aol toolbar\aoltb.dll

BHO: Symantec NCO BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - c:\program files\norton internet security\engine\16.8.0.41\coIEPlg.dll

BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\program files\norton internet security\engine\16.8.0.41\IPSBHO.DLL

BHO: AIM Toolbar Loader: {b0cda128-b425-4eef-a174-61a11ac5dbf8} - c:\program files\aim toolbar\aimtb.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - c:\program files\norton internet security\engine\16.8.0.41\coIEPlg.dll

TB: AIM Toolbar: {61539ecd-cc67-4437-a03c-9aaccbd14326} - c:\program files\aim toolbar\aimtb.dll

TB: ALOT Toolbar: {5aa2ba46-9913-4dc7-9620-69ab0fa17ae7} - c:\program files\alot\bin\alot.dll

TB: AOL Toolbar: {ba00b7b1-0351-477a-b948-23e3ee5a73d4} - c:\program files\aol toolbar\aoltb.dll

TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -

uRun: [CTSyncU.exe] "c:\program files\creative\sync manager unicode\CTSyncU.exe"

mRun: [RTHDCPL] RTHDCPL.EXE

mRun: [Recguard] c:\windows\sminst\RECGUARD.EXE

mRun: [PCDrProfiler]

mRun: [HPBootOp] "c:\program files\hewlett-packard\hp boot optimizer\HPBootOp.exe" /run

mRun: [HostManager] c:\program files\common files\aol\1225423384\ee\AOLSoftware.exe

mRun: [EKIJ5000StatusMonitor] c:\windows\system32\spool\drivers\w32x86\3\EKIJ5000MUI.exe

mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot

mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime

mRun: [iSUSPM Startup] c:\progra~1\common~1\instal~1\update~1\ISUSPM.exe -startup

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [iSUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start

mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [userFaultCheck] %systemroot%\system32\dumprep 0 -u

mRun: [ArcSoft Connection Service] c:\program files\common files\arcsoft\connection service\bin\ACDaemon.exe

mRun: [Nikon Transfer Monitor] c:\program files\common files\nikon\monitor\NkMonitor.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe

IE: {E2D4D26B-0180-43a4-B05F-462D6D54C789} - c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\iebutton\support.htm

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab

DPF: {48DD0448-9209-4F81-9F6D-D83562940134} - hxxp://lads.myspace.com/upload/MySpaceUploader1006.cab

DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6770.cab

DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} - hxxps://webdl.symantec.com/activex/symdlmgr.cab

DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

Handler: symres - {AA1061FE-6C41-421f-9344-69640C9732AB} - c:\program files\norton internet security\engine\16.8.0.41\CoIEPlg.dll

Notify: AtiExtEvent - Ati2evxx.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

============= SERVICES / DRIVERS ===============

R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\nis\1008000.029\SymEFA.sys [2010-1-27 310320]

R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\nis\1008000.029\BHDrvx86.sys [2010-1-27 259632]

R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\nis\1008000.029\cchpx86.sys [2010-1-27 482432]

R1 IDSxpx86;IDSxpx86;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\ipsdefs\20100825.001\IDSXpx86.sys [2010-8-26 331640]

R2 KodakSvc;Kodak AiO Device Service;c:\program files\kodak\printer\center\KodakSvc.exe [2008-10-2 28672]

R2 Norton Internet Security;Norton Internet Security;c:\program files\norton internet security\engine\16.8.0.41\ccSvcHst.exe [2010-1-27 117640]

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2010-8-25 102448]

R3 NAVENG;NAVENG;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\virusdefs\20100826.002\NAVENG.SYS [2010-8-26 85424]

R3 NAVEX15;NAVEX15;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\virusdefs\20100826.002\NAVEX15.SYS [2010-8-26 1362608]

=============== Created Last 30 ================

2010-08-26 23:04:06 0 ----a-w- c:\documents and settings\hp_owner\defogger_reenable

2010-08-25 22:49:20 0 d-----w- c:\program files\Trend Micro

2010-08-22 19:11:18 0 d-----w- c:\docume~1\hp_owner\applic~1\Malwarebytes

2010-08-22 19:11:01 0 d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes

2010-08-18 23:49:11 0 ----a-w- c:\windows\ViewNX.INI

2010-08-18 23:39:49 0 d-----w- c:\program files\common files\muvee Technologies

2010-08-18 23:38:35 0 d-----w- c:\docume~1\alluse~1\applic~1\Extensions

2010-08-18 19:48:29 20 ---h--w- c:\docume~1\alluse~1\applic~1\PKP_DLdw.DAT

2010-08-18 19:48:29 0 d-----w- c:\docume~1\alluse~1\applic~1\Fonts

2010-08-18 19:45:18 0 d-----w- c:\program files\common files\Nikon

2010-08-18 19:45:08 0 d-----w- c:\program files\Nikon

2010-08-18 19:43:17 20 ---h--w- c:\docume~1\alluse~1\applic~1\PKP_DLdu.DAT

2010-08-18 19:39:35 0 d--h--w- c:\docume~1\alluse~1\applic~1\ArcSoft

2010-08-09 02:48:19 664 ----a-w- c:\windows\system32\d3d9caps.dat

==================== Find3M ====================

2010-08-15 04:11:30 6124 ----a-w- c:\docume~1\hp_owner\applic~1\wklnhst.dat

2010-07-27 06:30:35 8462336 ------w- c:\windows\system32\dllcache\shell32.dll

2010-07-17 10:00:04 423656 ----a-w- c:\windows\system32\deployJava1.dll

2010-06-14 14:31:20 744448 ------w- c:\windows\system32\dllcache\helpsvc.exe

2004-08-04 11:00:00 94784 --sh--w- c:\windows\twain.dll

2008-04-14 00:12:07 50688 --sh--w- c:\windows\twain_32.dll

2008-04-14 00:11:56 1028096 --sh--w- c:\windows\system32\mfc42.dll

2008-04-14 00:12:01 57344 --sh--w- c:\windows\system32\msvcirt.dll

2008-04-14 00:12:01 413696 --sha-w- c:\windows\system32\msvcp60.dll

2008-04-14 00:12:01 343040 --sha-w- c:\windows\system32\msvcrt.dll

2008-04-14 00:12:02 551936 --sha-w- c:\windows\system32\oleaut32.dll

2008-04-14 00:12:02 84992 --sh--w- c:\windows\system32\olepro32.dll

2008-04-14 00:12:32 11776 --sh--w- c:\windows\system32\regsvr32.exe

2008-10-31 06:20:13 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008103120081101\index.dat

============= FINISH: 18:09:15.56 ===============

ark.zip

Attach.zip

screen317 · August 29, 2010

Hi and welcome to Malwarebytes.

Please update MBAM, run a Quick Scan, and post its log.

Next, please visit this webpage for instructions for running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

When the tool is finished, it will produce a report for you.
Please post the C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system.

-screen317

Msmich1 · August 30, 2010

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4503

Windows 5.1.2600 Service Pack 3

Internet Explorer 7.0.5730.13

8/29/2010 2:10:48 PM

mbam-log-2010-08-29 (14-10-48).txt

Scan type: Quick scan

Objects scanned: 150552

Time elapsed: 25 minute(s), 47 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

ComboFix 10-08-28.02 - HP_Owner 08/29/2010 16:45:30.1.2 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.447.133 [GMT -5:00]

Running from: c:\documents and settings\HP_Owner\Desktop\ComboFix.exe

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\docume~1\HP_Owner\LOCALS~1\Temp\install_flash_player.exe

c:\documents and settings\HP_Owner\Application Data\alot

c:\documents and settings\HP_Owner\Application Data\alot\BrowserSearch\BrowserSearch.xml

c:\documents and settings\HP_Owner\Application Data\alot\BrowserSearch\BrowserSearch.xml.backup

c:\documents and settings\HP_Owner\Application Data\alot\Button_0\Button_0.xml

c:\documents and settings\HP_Owner\Application Data\alot\Button_0\Button_0.xml.backup

c:\documents and settings\HP_Owner\Application Data\alot\Button_1\Button_1.xml

c:\documents and settings\HP_Owner\Application Data\alot\Button_1\Button_1.xml.backup

c:\documents and settings\HP_Owner\Application Data\alot\Button_2\Button_2.xml

c:\documents and settings\HP_Owner\Application Data\alot\Button_2\Button_2.xml.backup

c:\documents and settings\HP_Owner\Application Data\alot\Button_3\Button_3.xml

c:\documents and settings\HP_Owner\Application Data\alot\Button_3\Button_3.xml.backup

c:\documents and settings\HP_Owner\Application Data\alot\Button_4\Button_4.xml

c:\documents and settings\HP_Owner\Application Data\alot\Button_4\Button_4.xml.backup

c:\documents and settings\HP_Owner\Application Data\alot\Button_5\Button_5.xml

c:\documents and settings\HP_Owner\Application Data\alot\Button_5\Button_5.xml.backup

c:\documents and settings\HP_Owner\Application Data\alot\Button_6\Button_6.xml

c:\documents and settings\HP_Owner\Application Data\alot\Button_6\Button_6.xml.backup

c:\documents and settings\HP_Owner\Application Data\alot\Button_7\Button_7.xml

c:\documents and settings\HP_Owner\Application Data\alot\Button_7\Button_7.xml.backup

c:\documents and settings\HP_Owner\Application Data\alot\Button_8\Button_8.xml

c:\documents and settings\HP_Owner\Application Data\alot\Button_8\Button_8.xml.backup

c:\documents and settings\HP_Owner\Application Data\alot\Button_9\Button_9.xml

c:\documents and settings\HP_Owner\Application Data\alot\Button_9\Button_9.xml.backup

c:\documents and settings\HP_Owner\Application Data\alot\configurator\configurator.xml

c:\documents and settings\HP_Owner\Application Data\alot\configurator\configurator.xml.backup

c:\documents and settings\HP_Owner\Application Data\alot\contextMenu\contextMenu.xml

c:\documents and settings\HP_Owner\Application Data\alot\contextMenu\contextMenu.xml.backup

c:\documents and settings\HP_Owner\Application Data\alot\ErrorSearch\ErrorSearch.xml

c:\documents and settings\HP_Owner\Application Data\alot\ErrorSearch\ErrorSearch.xml.backup

c:\documents and settings\HP_Owner\Application Data\alot\products\products.xml

c:\documents and settings\HP_Owner\Application Data\alot\products\products.xml.backup

c:\documents and settings\HP_Owner\Application Data\alot\Resources\BrowserSearch\alot_search_defend.html

c:\documents and settings\HP_Owner\Application Data\alot\Resources\BrowserSearch\images\favicon.ico

c:\documents and settings\HP_Owner\Application Data\alot\Resources\Button_0\images\alot_logo_button.bmp

c:\documents and settings\HP_Owner\Application Data\alot\Resources\Button_0\images\alot_logo_button.png

c:\documents and settings\HP_Owner\Application Data\alot\Resources\Button_1\images\alot_image_search.bmp

c:\documents and settings\HP_Owner\Application Data\alot\Resources\Button_1\images\alot_image_search.png

c:\documents and settings\HP_Owner\Application Data\alot\Resources\Button_1\images\alot_news_search.bmp

c:\documents and settings\HP_Owner\Application Data\alot\Resources\Button_1\images\alot_news_search.png

c:\documents and settings\HP_Owner\Application Data\alot\Resources\Button_1\images\alot_search_button.bmp

c:\documents and settings\HP_Owner\Application Data\alot\Resources\Button_1\images\alot_search_button.png

c:\documents and settings\HP_Owner\Application Data\alot\Resources\Button_1\images\alot_shop_search.bmp

c:\documents and settings\HP_Owner\Application Data\alot\Resources\Button_1\images\alot_shop_search.png

c:\documents and settings\HP_Owner\Application Data\alot\Resources\Button_1\images\alot_videos_search.bmp

c:\documents and settings\HP_Owner\Application Data\alot\Resources\Button_1\images\alot_videos_search.png

c:\documents and settings\HP_Owner\Application Data\alot\Resources\Button_1\images\alot_web_search.bmp

c:\documents and settings\HP_Owner\Application Data\alot\Resources\Button_1\images\alot_web_search.png

c:\documents and settings\HP_Owner\Application Data\alot\Resources\Button_2\images\alot_configure.bmp

c:\documents and settings\HP_Owner\Application Data\alot\Resources\Button_2\images\alot_configure.png

c:\documents and settings\HP_Owner\Application Data\alot\Resources\Button_3\images\default_1008_alot_map_widget_default.bmp

c:\documents and settings\HP_Owner\Application Data\alot\Resources\Button_3\images\default_1008_alot_map_widget_default.png

c:\documents and settings\HP_Owner\Application Data\alot\Resources\Button_4\images\1011_icon.bmp

c:\documents and settings\HP_Owner\Application Data\alot\Resources\Button_4\images\1011_icon.png

c:\documents and settings\HP_Owner\Application Data\alot\Resources\Button_4\images\default_1011_alot_maps_tools.bmp

c:\documents and settings\HP_Owner\Application Data\alot\Resources\Button_4\images\default_1011_alot_maps_tools.png

c:\documents and settings\HP_Owner\Application Data\alot\Resources\Button_5\images\default_1870_mrkt_traffic.bmp

c:\documents and settings\HP_Owner\Application Data\alot\Resources\Button_5\images\default_1870_mrkt_traffic.png

c:\documents and settings\HP_Owner\Application Data\alot\Resources\Button_6\images\alert-icon.png

c:\documents and settings\HP_Owner\Application Data\alot\Resources\Button_6\images\clear.png

c:\documents and settings\HP_Owner\Application Data\alot\Resources\Button_6\images\cloudy.png

c:\documents and settings\HP_Owner\Application Data\alot\Resources\Button_6\images\default_1007_alot_weather_widget.bmp

c:\documents and settings\HP_Owner\Application Data\alot\Resources\Button_6\images\default_1007_alot_weather_widget.png

c:\documents and settings\HP_Owner\Application Data\alot\Resources\Button_6\images\mcloud.png

c:\documents and settings\HP_Owner\Application Data\alot\Resources\Button_6\images\nclear.png

c:\documents and settings\HP_Owner\Application Data\alot\Resources\Button_6\images\nmcloud.png

c:\documents and settings\HP_Owner\Application Data\alot\Resources\Button_6\images\pcloud.png

c:\documents and settings\HP_Owner\Application Data\alot\Resources\Button_6\images\rain.png

c:\documents and settings\HP_Owner\Application Data\alot\Resources\Button_6\images\shower.png

c:\documents and settings\HP_Owner\Application Data\alot\Resources\Button_7\images\default_2254_email.bmp

c:\documents and settings\HP_Owner\Application Data\alot\Resources\Button_7\images\default_2254_email.png

c:\documents and settings\HP_Owner\Application Data\alot\Resources\Button_7\images\icon_configure.JPG

c:\documents and settings\HP_Owner\Application Data\alot\Resources\Button_8\images\2775_icon.bmp

c:\documents and settings\HP_Owner\Application Data\alot\Resources\Button_8\images\2775_icon.png

c:\documents and settings\HP_Owner\Application Data\alot\Resources\Button_9\images\2823_icon.png

c:\documents and settings\HP_Owner\Application Data\alot\Resources\contextMenu\images\alot_icon.bmp

c:\documents and settings\HP_Owner\Application Data\alot\Resources\contextMenu\images\alot_icon.png

c:\documents and settings\HP_Owner\Application Data\alot\Resources\contextMenu\images\alot_logo_button.bmp

c:\documents and settings\HP_Owner\Application Data\alot\Resources\contextMenu\images\alot_logo_button.png

c:\documents and settings\HP_Owner\Application Data\alot\Resources\Shared\domains.dat

c:\documents and settings\HP_Owner\Application Data\alot\Resources\Shared\images\alot_brand.png

c:\documents and settings\HP_Owner\Application Data\alot\Resources\Shared\images\alot_splitter.png

c:\documents and settings\HP_Owner\Application Data\alot\Resources\Shared\images\discover.png

c:\documents and settings\HP_Owner\Application Data\alot\Resources\Shared\images\intro_popup.png

c:\documents and settings\HP_Owner\Application Data\alot\Resources\Shared\images\spinner.bmp

c:\documents and settings\HP_Owner\Application Data\alot\Resources\Shared\images\widget_bottom.bmp

c:\documents and settings\HP_Owner\Application Data\alot\Resources\Shared\images\widget_btnclose0.bmp

c:\documents and settings\HP_Owner\Application Data\alot\Resources\Shared\images\widget_btnclose1.bmp

c:\documents and settings\HP_Owner\Application Data\alot\Resources\Shared\images\widget_btnconfig0.bmp

c:\documents and settings\HP_Owner\Application Data\alot\Resources\Shared\images\widget_btnconfig1.bmp

c:\documents and settings\HP_Owner\Application Data\alot\Resources\Shared\images\widget_btnrefresh0.bmp

c:\documents and settings\HP_Owner\Application Data\alot\Resources\Shared\images\widget_btnrefresh1.bmp

c:\documents and settings\HP_Owner\Application Data\alot\Resources\Shared\images\widget_caption.bmp

c:\documents and settings\HP_Owner\Application Data\alot\Resources\Shared\images\widget_error_bg.bmp

c:\documents and settings\HP_Owner\Application Data\alot\Resources\Shared\images\widget_error_close.bmp

c:\documents and settings\HP_Owner\Application Data\alot\Resources\Shared\images\widget_error_icon.bmp

c:\documents and settings\HP_Owner\Application Data\alot\TimerManager\TimerManager.xml

c:\documents and settings\HP_Owner\Application Data\alot\TimerManager\TimerManager.xml.backup

c:\documents and settings\HP_Owner\Application Data\alot\toolbar.xml

c:\documents and settings\HP_Owner\Application Data\alot\toolbar.xml.backup

c:\documents and settings\HP_Owner\Application Data\alot\toolbarContextMenu\toolbarContextMenu.xml

c:\documents and settings\HP_Owner\Application Data\alot\toolbarContextMenu\toolbarContextMenu.xml.backup

c:\documents and settings\HP_Owner\Application Data\alot\ToolbarSearch\ToolbarSearch.xml

c:\documents and settings\HP_Owner\Application Data\alot\ToolbarSearch\ToolbarSearch.xml.backup

c:\documents and settings\HP_Owner\Application Data\alot\Updater\Updater.xml

c:\documents and settings\HP_Owner\Application Data\alot\Updater\Updater.xml.backup

D:\Autorun.inf

Infected copy of c:\windows\system32\drivers\atapi.sys was found and disinfected

Restored copy from - Kitty had a snack

.

((((((((((((((((((((((((( Files Created from 2010-07-28 to 2010-08-29 )))))))))))))))))))))))))))))))

.

2010-08-29 16:02 . 2010-08-29 16:02 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple Computer

2010-08-29 16:02 . 2010-08-29 16:02 -------- d-----w- c:\documents and settings\NetworkService\Application Data\Apple Computer

2010-08-27 07:23 . 2010-08-27 07:23 -------- d-----w- c:\documents and settings\HP_Owner\Local Settings\Application Data\Symantec

2010-08-27 00:02 . 2010-04-29 20:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-08-27 00:02 . 2010-08-27 07:18 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-08-27 00:02 . 2010-04-29 20:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-08-26 06:21 . 2010-08-27 07:17 -------- d-----w- c:\program files\Windows Live Safety Center

2010-08-25 22:49 . 2010-08-25 22:49 -------- d-----w- c:\program files\Trend Micro

2010-08-22 19:11 . 2010-08-22 19:11 -------- d-----w- c:\documents and settings\HP_Owner\Application Data\Malwarebytes

2010-08-22 19:11 . 2010-08-22 19:11 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2010-08-22 05:53 . 2010-08-22 05:53 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Identities

2010-08-18 23:39 . 2010-08-18 23:39 -------- d-----w- c:\program files\Common Files\muvee Technologies

2010-08-18 23:39 . 2010-08-18 23:39 -------- d-----w- c:\documents and settings\All Users\Application Data\Nikon

2010-08-18 23:38 . 2010-08-18 23:38 -------- d-----w- c:\documents and settings\All Users\Application Data\Extensions

2010-08-18 23:01 . 2010-08-18 23:48 -------- d-----w- c:\documents and settings\HP_Owner\Application Data\Nikon

2010-08-18 19:48 . 2010-08-18 19:48 -------- d-----w- c:\documents and settings\All Users\Application Data\Fonts

2010-08-18 19:45 . 2010-08-18 23:48 -------- d-----w- c:\program files\Common Files\Nikon

2010-08-18 19:45 . 2010-08-18 23:42 -------- d-----w- c:\program files\Nikon

2010-08-18 19:43 . 2010-08-18 19:48 -------- d-----w- c:\documents and settings\All Users\Application Data\Ultima_T15

2010-08-18 19:43 . 2010-08-18 19:48 -------- d-----w- c:\documents and settings\All Users\Application Data\EnterNHelp

2010-08-18 19:39 . 2010-08-18 19:39 -------- d-----w- c:\documents and settings\HP_Owner\Local Settings\Application Data\ArcSoft

2010-08-18 19:39 . 2010-08-18 23:28 -------- d--h--w- c:\documents and settings\All Users\Application Data\ArcSoft

2010-08-18 19:37 . 2010-08-18 19:37 -------- d-----w- c:\program files\Common Files\ArcSoft

2010-08-18 19:37 . 2010-08-18 23:28 -------- d-----w- c:\documents and settings\HP_Owner\Application Data\ArcSoft

2010-08-12 14:52 . 2010-08-12 14:53 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe

2010-08-09 16:18 . 2010-08-09 16:18 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache

2010-08-09 02:48 . 2010-08-29 14:45 1324 ----a-w- c:\windows\system32\d3d9caps.dat

2010-08-09 02:14 . 2010-08-09 02:14 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-08-29 14:18 . 2008-10-31 03:23 -------- d-----w- c:\program files\Common Files\aol

2010-08-25 21:29 . 2006-12-15 08:49 -------- d-----w- c:\program files\Quicken

2010-08-22 18:46 . 2006-12-15 09:02 -------- d-----w- c:\program files\Yahoo!

2010-08-22 18:40 . 2008-10-31 05:31 -------- d-----w- c:\program files\Google

2010-08-22 18:22 . 2010-01-02 21:30 -------- d-----w- c:\documents and settings\HP_Owner\Application Data\HPAppData

2010-08-22 18:19 . 2008-12-05 03:35 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer

2010-08-19 20:29 . 2010-08-18 19:48 20 ---h--w- c:\documents and settings\All Users\Application Data\PKP_DLdw.DAT

2010-08-18 23:46 . 2010-08-18 23:46 49152 ----a-r- c:\documents and settings\HP_Owner\Application Data\Microsoft\Installer\{D2FCC1AE-6311-47C5-8130-C6C66D77DD71}\ARPPRODUCTICON.exe

2010-08-18 23:45 . 2010-08-18 23:45 335872 ----a-r- c:\documents and settings\HP_Owner\Application Data\Microsoft\Installer\{237CD223-1B9D-47E8-A76C-E478B83CCEA2}\ARPPRODUCTICON.exe

2010-08-18 23:43 . 2010-08-18 23:43 57344 ----a-r- c:\documents and settings\HP_Owner\Application Data\Microsoft\Installer\{87441A59-5E64-4096-A170-14EFE67200C3}\ARPPRODUCTICON.exe

2010-08-18 23:38 . 2010-08-18 19:43 20 ---h--w- c:\documents and settings\All Users\Application Data\PKP_DLdu.DAT

2010-08-18 20:02 . 2006-12-15 08:31 -------- d--h--w- c:\program files\InstallShield Installation Information

2010-08-18 19:37 . 2008-11-16 05:25 -------- d-----w- c:\program files\ArcSoft

2010-08-15 04:11 . 2008-12-27 02:45 6124 ----a-w- c:\documents and settings\HP_Owner\Application Data\wklnhst.dat

2010-08-06 15:47 . 2010-05-14 09:35 -------- d-----w- c:\documents and settings\HP_Owner\Application Data\HpUpdate

2010-08-05 07:02 . 2006-12-15 08:19 -------- d-----w- c:\program files\Common Files\Java

2010-08-05 07:01 . 2010-08-05 07:01 503808 ----a-w- c:\documents and settings\HP_Owner\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-3f1b7eca-n\msvcp71.dll

2010-08-05 07:01 . 2010-08-05 07:01 499712 ----a-w- c:\documents and settings\HP_Owner\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-3f1b7eca-n\jmc.dll

2010-08-05 07:01 . 2010-08-05 07:01 348160 ----a-w- c:\documents and settings\HP_Owner\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-3f1b7eca-n\msvcr71.dll

2010-08-05 07:01 . 2010-08-05 07:01 61440 ----a-w- c:\documents and settings\HP_Owner\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-5739af67-n\decora-sse.dll

2010-08-05 07:01 . 2010-08-05 07:01 12800 ----a-w- c:\documents and settings\HP_Owner\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-5739af67-n\decora-d3d.dll

2010-08-05 07:00 . 2006-12-15 08:19 -------- d-----w- c:\program files\Java

2010-07-17 10:00 . 2010-06-05 03:55 423656 ----a-w- c:\windows\system32\deployJava1.dll

2010-06-14 14:31 . 2004-08-04 11:00 744448 ----a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe

2004-08-04 11:00 . 2004-08-04 11:00 94784 --sh--w- c:\windows\twain.dll

2008-04-14 00:12 . 2004-08-04 11:00 50688 --sh--w- c:\windows\twain_32.dll

2008-04-14 00:11 . 2004-08-04 11:00 1028096 --sh--w- c:\windows\system32\mfc42.dll

2008-04-14 00:12 . 2004-08-04 11:00 57344 --sh--w- c:\windows\system32\msvcirt.dll

2008-04-14 00:12 . 2004-08-04 11:00 413696 --sha-w- c:\windows\system32\msvcp60.dll

2008-04-14 00:12 . 2004-08-04 11:00 343040 --sha-w- c:\windows\system32\msvcrt.dll

2008-04-14 00:12 . 2004-08-04 11:00 551936 --sha-w- c:\windows\system32\oleaut32.dll

2008-04-14 00:12 . 2004-08-04 11:00 84992 --sh--w- c:\windows\system32\olepro32.dll

2008-04-14 00:12 . 2004-08-04 11:00 11776 --sh--w- c:\windows\system32\regsvr32.exe

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTSyncU.exe"="c:\program files\Creative\Sync Manager Unicode\CTSyncU.exe" [2006-08-07 700416]

"AOL Fast Start"="c:\program files\AOL 9.5\AOL.EXE" [2010-03-23 29520]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RTHDCPL"="RTHDCPL.EXE" [2006-06-14 16239616]

"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2005-07-23 237568]

"HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2006-02-16 249856]

"HostManager"="c:\program files\Common Files\AOL\1225423384\ee\AOLSoftware.exe" [2010-02-10 41800]

"EKIJ5000StatusMonitor"="c:\windows\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe" [2008-08-21 1306624]

"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2006-12-15 180269]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-11-04 413696]

"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-28 221184]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]

"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-28 81920]

"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2010-03-12 49208]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-03-18 207360]

"Nikon Transfer Monitor"="c:\program files\Common Files\Nikon\Monitor\NkMonitor.exe" [2009-09-15 479232]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2008-10-16 214360]

c:\documents and settings\Default User\Start Menu\Programs\Startup\

Pin.lnk - c:\hp\bin\CLOAKER.EXE [2006-12-15 27136]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]

@="FSFilter Activity Monitor"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Common Files\\aol\\acs\\AOLDial.exe"=

"c:\\Program Files\\Common Files\\aol\\acs\\AOLacsd.exe"=

"c:\\Program Files\\Common Files\\aol\\1225423384\\ee\\aolsoftware.exe"=

"c:\\Program Files\\AOL 9.1\\waol.exe"=

"c:\\Program Files\\Common Files\\aol\\TopSpeed\\3.0\\aoltpsd3.exe"=

"c:\\Program Files\\Common Files\\aol\\Loader\\aolload.exe"=

"c:\\Program Files\\Common Files\\aol\\System Information\\sinf.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=

"c:\\Program Files\\AOL 9.5\\waol.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfcCopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxs08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqfxt08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgplgtupl.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgpc01.exe"=

R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NIS\1008000.029\SymEFA.sys [1/27/2010 6:47 PM 310320]

R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\NIS\1008000.029\BHDrvx86.sys [1/27/2010 6:47 PM 259632]

R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NIS\1008000.029\cchpx86.sys [1/27/2010 6:46 PM 482432]

R1 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100827.001\IDSXpx86.sys [8/27/2010 7:15 PM 331640]

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [8/25/2010 10:33 PM 102448]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

HPService REG_MULTI_SZ HPSLPSVC

hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

.

Contents of the 'Scheduled Tasks' folder

2010-08-29 c:\windows\Tasks\User_Feed_Synchronization-{353E397A-1201-44F1-8EC8-E1D41A949D91}.job

- c:\windows\system32\msfeedssync.exe [2007-08-14 00:36]

.

------- Supplementary Scan -------

.

uSearchMigratedDefaultURL = hxxp://search.aol.com/aolcom/search?query={searchTerms}&invocationType=msie70a

uInternet Settings,ProxyOverride = *.local

uSearchURL,(Default) = hxxp://search.alot.com/web?q=&pr=auto&client_id=017B7BE001CAB9A60349301D&src_id=20001&camp_id=848&tb_version=2.5.9000.490

.

- - - - ORPHANS REMOVED - - - -

HKLM-Run-PCDrProfiler - (no file)

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-08-29 17:06

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Norton Internet Security]

"ImagePath"="\"c:\program files\Norton Internet Security\Engine\16.8.0.41\ccSvcHst.exe\" /s \"Norton Internet Security\" /m \"c:\program files\Norton Internet Security\Engine\16.8.0.41\diMaster.dll\" /prefetch:1"

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(804)

c:\windows\system32\Ati2evxx.dll

.

Completion time: 2010-08-29 17:15:25

ComboFix-quarantined-files.txt 2010-08-29 22:15

Pre-Run: 34,129,784,832 bytes free

Post-Run: 36,859,916,288 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

- - End Of File - - ED241A24FC00EC5F23485DE04BA7A24D

DDS (Ver_10-03-17.01) - NTFSx86

Run by HP_Owner at 15:42:30.35 on Sun 08/29/2010

Internet Explorer: 7.0.5730.13

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.447.137 [GMT -5:00]

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\Common Files\AOL\1225423384\ee\AOLSoftware.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe

C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe

C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

svchost.exe

C:\Program Files\AOL 9.5\waol.exe

C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\system32\svchost.exe -k hpdevmgmt

C:\WINDOWS\system32\svchost.exe -k HPService

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Kodak\printer\center\KodakSvc.exe

C:\WINDOWS\System32\svchost.exe -k HPZ12

C:\Program Files\Norton Internet Security\Engine\16.8.0.41\ccSvcHst.exe

C:\WINDOWS\System32\svchost.exe -k HPZ12

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Program Files\Norton Internet Security\Engine\16.8.0.41\ccSvcHst.exe

C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe

C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe

C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe

C:\Program Files\AOL 9.5\shellmon.exe

C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

c:\windows\system\hpsysdrv.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Common Files\AOL\Topspeed\3.0\aoltpsd3.exe

C:\WINDOWS\system32\NOTEPAD.EXE