XP SP3 Hang on shut Down

CompUser1-11 · February 4, 2011

A little over 3 weeks ago I was helped by one of your excellent volunteers who assisted me to remove trojans from my computer. My machine ran without issue for a short period and then began to hang on shutdown. This problem is a recurrance of the original problem. This time I don't get any noted problems after running your antimalware program. This install was on a brand new harddrive that was partitioned and formatted NTFS. Thanks for your help.

DDS.txt

ark.txt

CompUser1-11 · February 5, 2011

Hmmm, do I need to elaborate any further in order to help troubleshoot my machine?

MrCharlie · February 5, 2011

Have you scanned for malware??

Take a look at the links below:

http://www.aumha.org/win5/a/shtdwnxp.php

http://www.theeldergeek.com/shutdown_issues_in_xp.htm

http://support.microsoft.com/kb/308029

MrC

CompUser1-11 · February 5, 2011

Thank you for your reply. I have scanned my computer with your antimaleware tool, which came up negative. I really thinnk that my machine is still infected because of the warnings that I get from Norton. Please see attached screenshot.

MrCharlie · February 5, 2011

Let me take a quick look at a HJT log of the system before we going on:

Please post a HJT log of the system:

You can download the HJT installer HERE:

Doubleclick HJTInstall.exe to install it.

By default it will install to C:\Program Files\Trend Micro\HijackThis .

Click on Install. It will create a HijackThis icon on the desktop.

Once installed, it will launch Hijackthis. Click on the Do a system scan and save a logfile button.

It will scan and the log should open in notepad.

Save the log to a convenient location.

Copy and paste it into your post.

MrC

CompUser1-11 · February 5, 2011

Here are the results of the HJT Log...

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 2:26:20 PM, on 2/5/2011

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe

C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Creative\Shared Files\CTAudSvc.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\system32\CTsvcCDA.EXE

C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe

C:\Program Files\Common Files\LightScribe\LSSrvc.exe

C:\Program Files\Nero\Update\NASvc.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Norton Internet Security\Engine\18.5.0.125\ccSvcHst.exe

C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE

C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe

C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe

C:\Program Files\Nero\Nero 10\Nero BackItUp\NBAgent.exe

C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe

C:\WINDOWS\system32\SearchIndexer.exe

C:\WINDOWS\system32\hphmon03.exe

C:\Program Files\Hewlett-Packard\PhotoSmart\HP Share-to-Web\hpgs2wnd.exe

C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe

C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe

C:\Program Files\Norton Internet Security\Engine\18.5.0.125\ccSvcHst.exe

C:\PROGRA~1\HEWLET~1\PHOTOS~1\HPSHAR~1\hpgs2wnf.exe

C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

C:\WINDOWS\system32\CTXFIHLP.EXE

C:\WINDOWS\SYSTEM32\CTXFISPI.EXE

C:\WINDOWS\CTHELPER.EXE

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\Logitech\SetPoint\LBTWiz.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe

C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\Program Files\Microsoft ActiveSync\Wcescomm.exe

C:\Program Files\WinTV\Ir.exe

C:\Program Files\Creative Home\Hallmark Card Studio 2011 Deluxe\Planner\PLNRnote.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Program Files\Logitech\SetPoint\SetPoint.exe

C:\Program Files\Windows Desktop Search\WindowsSearch.exe

C:\PROGRA~1\MI3AA1~1\rapimgr.exe

C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE

C:\Program Files\Creative\ShareDLL\CADI\NotiMan.exe

C:\WINDOWS\system32\HPHipm09.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe

C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe

C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe

C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_clipbook.exe

C:\WINDOWS\system32\SearchProtocolHost.exe

C:\WINDOWS\system32\msiexec.exe

C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\18.5.0.125\coIEPlg.dll

O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\18.5.0.125\IPS\IPSBHO.DLL

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll

O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll

O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\18.5.0.125\coIEPlg.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [CTDVDDET] "C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE"

O4 - HKLM\..\Run: [RCSystem] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" RCSystem * -Startup

O4 - HKLM\..\Run: [AudioDrvEmulator] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "C:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll"

O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe" /r

O4 - HKLM\..\Run: [updReg] C:\WINDOWS\UpdReg.EXE

O4 - HKLM\..\Run: [NBAgent] "C:\Program Files\Nero\Nero 10\Nero BackItUp\NBAgent.exe" /WinStart

O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe

O4 - HKLM\..\Run: [HPHmon03] C:\WINDOWS\system32\hphmon03.exe

O4 - HKLM\..\Run: [CXMon] "C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe"

O4 - HKLM\..\Run: [share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\PhotoSmart\HP Share-to-Web\hpgs2wnd.exe

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE

O4 - HKLM\..\Run: [bluetooth Connection Assistant] LBTWIZ.EXE -silent

O4 - HKLM\..\Run: [bluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R

O4 - HKCU\..\Run: [LightScribe Control Panel] "C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe" -hidden

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\Wcescomm.exe"

O4 - Startup: Logitech . Product Registration.lnk = C:\Program Files\Common Files\Logishrd\eReg\SetPoint\eReg.exe

O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

O4 - Global Startup: AutoStart IR.lnk = C:\Program Files\WinTV\Ir.exe

O4 - Global Startup: Event Planner Reminder.lnk = C:\Program Files\Creative Home\Hallmark Card Studio 2011 Deluxe\Planner\PLNRnote.exe

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe

O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000

O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll

O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll

O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll

O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL

O9 - Extra button: Show or hide HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {0067DBFC-A752-458C-AE6E-B9C7E63D4824} (Device Detection) - http://www.logitech.com/devicedetector/plu...Detection32.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1294359419529

O16 - DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} (Creative Software AutoUpdate) - http://ccfiles.creative.com/Web/softwareup...101/CTSUEng.cab

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1294359461420

O16 - DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} (Creative Software AutoUpdate Support Package) - http://ccfiles.creative.com/Web/softwareup...13/CTPIDPDE.cab

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://ccfiles.creative.com/Web/softwareup...15113/CTPID.cab

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll

O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe

O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE

O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTAudSvc.exe

O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe

O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

O23 - Service: @C:\Program Files\Nero\Update\NASvc.exe,-200 (NAUpdate) - Nero AG - C:\Program Files\Nero\Update\NASvc.exe

O23 - Service: Norton Internet Security (NIS) - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\18.5.0.125\ccSvcHst.exe

O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe

O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Pml Driver - HP - C:\WINDOWS\system32\HPHipm09.exe

O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

--

End of file - 15885 bytes

Thanks again

MrCharlie · February 5, 2011

Disable Search & Destroy teatimer and sdhelper:

http://www.malwarehelp.org/how-to-enabledi...t-teatimer.html

----------------------------

Then............

Download TDSSKiller to your Desktop.

Doubleclick on TDSSKiller.exe to run the application, then click on Start Scan.

Don't Change These Settings:

If an infected file is detected, the default action will be Cure, click on Continue.

If a suspicious file is detected, the default action will be Skip, click on Continue.

You may be asked you to reboot the computer to complete the process. Click on Reboot Now

To view the report:

Click the Report button and copy/paste the contents of it into your next reply.

Note:It will also create a log in the C:\ directory.

---------------------------------------

Please download and run ComboFix:

A few notes first:

[*]ComboFix is compatible exclusively with W2K, XP, Vista, and Windows 7

[*]ComboFix must be run from an Administrative account.

[*]Vista and W7 users - Right click, choose "Run as Administrator"

[*]It must be downloaded to and run from your desktop.

[*]Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can and will interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results". (see below)

[*]ComboFix Guide <---please read!

Download ComboFix from one of these locations: (you may have to use right click > save target as)

[*]Link 1

[*]Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

[*]Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon and choose disable/exit.

More info HERE<-------

They may interfere with the running of ComboFix.

Note: If you have AVG or CA Internet Security Suite installed, due to recent changes in how these AV's target the tool's internal files, they must be uninstalled before running ComboFix. If you have difficulty uninstalling the AV, download and run Opswat AppRemover

[*]Double click on ComboFix.exe & follow the prompts.

[*]Note: Combofix will run without the Recovery Console installed. Skip the Recovery Console part if you're running Vista or Windows 7.

[*] Note: If you have SP3, use the SP2 package.

If Vista or Windows 7, skip the Recovery Console part

[*]ComboFix will check to see if the Microsoft Windows Recovery Console is installed. It's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

[*]Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

[*]**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt using Copy / Paste in your next reply.

Notes:

[*]1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.

[*]2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.

[*]3. Combofix permanently prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security.

Keeping Autorun enabled on USB and other removable drives has become a significant security risk due to the increasing number of malware variants that can infect them and transfer the infection to your computer. Read USB-Based Malware Attacks and Please disable Autorun ASAP!.

[*]4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

If a reboot doesn't restore your connection, please try this:

Check HERE

For XP systems download and run WinSockFix and Here

Vista users: Check HERE

Windows 7 systems: Download and run this Winsockfix.bat

[*]5.Give ComboFix at least 20-30 minutes to finish if needed.

MrC

CompUser1-11 · February 5, 2011

I ran the 2 apps that you requested and here are their results...

ComboFix 11-02-05.01 - Teresa 02/05/2011 15:08:36.3.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1494 [GMT -5:00]

Running from: c:\documents and settings\Teresa\My Documents\ComboFix.exe

AV: Lavasoft Ad-Watch Live! Anti-Virus *Disabled/Updated* {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}

AV: Norton Internet Security *Disabled/Updated* {E10A9785-9598-4754-B552-92431C1C35F8}

FW: Norton Internet Security *Disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}

.

((((((((((((((((((((((((( Files Created from 2011-01-05 to 2011-02-05 )))))))))))))))))))))))))))))))

.

2011-02-05 19:25 . 2011-02-05 19:25 -------- d-----w- c:\program files\Trend Micro

2011-01-30 16:27 . 2011-01-30 16:27 -------- d-----w- c:\program files\iPod

2011-01-22 17:34 . 2011-01-22 17:34 -------- d-----w- c:\program files\Common Files\AnswerWorks 5.0

2011-01-22 17:34 . 2010-08-31 23:43 4199768 ----a-w- c:\windows\system32\cdintf400.dll

2011-01-22 17:33 . 2011-01-22 17:33 -------- d-----w- c:\program files\Common Files\Intuit

2011-01-22 17:33 . 2011-01-22 17:39 -------- d-----w- c:\program files\Quicken

2011-01-22 17:32 . 2011-01-22 17:32 -------- d-----w- c:\documents and settings\All Users\Application Data\Intuit

2011-01-18 14:42 . 2008-04-14 05:26 12800 -c--a-w- c:\windows\system32\dllcache\usb8023x.sys

2011-01-18 14:42 . 2008-04-14 05:26 12800 ----a-w- c:\windows\system32\drivers\usb8023x.sys

2011-01-18 14:42 . 2008-04-14 05:26 30592 -c--a-w- c:\windows\system32\dllcache\rndismpx.sys

2011-01-18 14:42 . 2008-04-14 05:26 30592 ----a-w- c:\windows\system32\drivers\rndismpx.sys

2011-01-18 14:41 . 2011-01-18 14:41 -------- d-----w- c:\program files\Microsoft ActiveSync

2011-01-18 14:31 . 2009-06-17 16:55 10384 ----a-w- c:\windows\system32\drivers\LBeepKE.sys

2011-01-18 14:30 . 2009-07-20 17:25 301656 ----a-w- c:\windows\system32\BtCoreIf.dll

2011-01-18 14:30 . 2007-12-14 21:13 53248 ----a-w- c:\windows\system32\LBTCoIns.DLL

2011-01-18 14:30 . 2009-07-20 17:26 84496 ----a-w- c:\windows\system32\KemXML.dll

2011-01-18 14:30 . 2009-07-20 17:26 117264 ----a-w- c:\windows\system32\KemWnd.dll

2011-01-18 14:30 . 2009-07-20 17:26 145936 ----a-w- c:\windows\system32\KemUtil.dll

2011-01-18 14:30 . 2009-07-20 17:26 170512 ----a-w- c:\windows\system32\kemutb.dll

2011-01-18 14:30 . 2011-01-20 13:20 -------- d-----w- c:\documents and settings\All Users\Application Data\Logitech

2011-01-18 14:30 . 2011-01-18 14:31 -------- d-----w- c:\program files\Common Files\Logishrd

2011-01-18 14:30 . 2011-01-18 14:30 -------- d-----w- c:\program files\Logitech

2011-01-10 22:59 . 2011-01-10 22:59 -------- d-----w- c:\program files\Common Files\Java

2011-01-10 22:58 . 2011-01-10 22:58 73728 ----a-w- c:\windows\system32\javacpl.cpl

2011-01-10 22:58 . 2011-01-10 22:58 472808 ----a-w- c:\windows\system32\deployJava1.dll

2011-01-10 22:58 . 2011-01-10 22:58 -------- d-----w- c:\program files\Java

2011-01-10 00:25 . 2011-01-10 00:25 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2011-01-10 00:25 . 2010-12-20 23:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-01-10 00:25 . 2011-01-10 23:35 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-01-10 00:25 . 2010-12-20 23:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-01-09 22:50 . 2011-01-09 23:06 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

2011-01-09 22:50 . 2011-01-09 22:51 -------- d-----w- c:\program files\Spybot - Search & Destroy

2011-01-09 21:55 . 2010-12-03 09:05 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys

2011-01-09 21:55 . 2011-01-09 21:55 98392 ----a-w- c:\windows\system32\drivers\SBREDrv.sys

2011-01-09 21:48 . 2011-01-09 21:48 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{2162CCC0-3A5F-4887-B51F-CE5F195B3620}

2011-01-09 21:48 . 2011-01-09 21:55 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft

2011-01-09 21:48 . 2011-01-09 21:48 -------- d-----w- c:\program files\Lavasoft

2011-01-09 20:39 . 2009-05-18 18:17 26600 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys

2011-01-09 20:39 . 2008-04-17 17:12 107368 ----a-w- c:\windows\system32\GEARAspi.dll

2011-01-09 20:38 . 2011-01-30 16:28 -------- d-----w- c:\program files\iTunes

2011-01-09 20:38 . 2011-01-09 20:39 -------- d-----w- c:\documents and settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}

2011-01-09 20:38 . 2011-01-09 20:38 -------- d-----w- c:\program files\QuickTime

2011-01-09 20:38 . 2011-01-09 20:38 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer

2011-01-09 20:38 . 2011-01-09 20:38 -------- d-----w- c:\program files\Apple Software Update

2011-01-09 20:37 . 2010-09-28 20:44 41984 ----a-w- c:\windows\system32\drivers\usbaapl.sys

2011-01-09 20:37 . 2010-09-28 20:44 4184352 ----a-w- c:\windows\system32\usbaaplrc.dll

2011-01-09 20:37 . 2011-01-09 20:37 -------- d-----w- c:\program files\Bonjour

2011-01-09 20:37 . 2011-01-30 16:27 -------- d-----w- c:\program files\Common Files\Apple

2011-01-09 20:37 . 2011-01-09 20:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple

2011-01-09 18:49 . 2011-01-09 18:49 -------- d-----w- c:\program files\Common Files\Creative

2011-01-09 18:49 . 2011-01-09 18:49 -------- d--h--w- c:\program files\Creative Installation Information

2011-01-09 17:58 . 2011-01-09 17:58 -------- d-----w- c:\program files\Common Files\Creative Labs Shared

2011-01-09 17:57 . 2008-02-04 15:27 102400 ----a-w- c:\windows\system32\cttele32.dll

2011-01-09 17:57 . 2011-01-09 17:57 -------- d-----w- c:\program files\OpenAL

2011-01-09 17:52 . 2009-05-18 19:34 22691984 ----a-w- c:\windows\system32\AppSetup.exe

2011-01-09 17:16 . 2003-06-13 04:25 7062 ----a-w- c:\windows\system32\audiopid.vxd

2011-01-09 16:58 . 2011-01-10 22:09 -------- d-----w- c:\program files\Windows Desktop Search

2011-01-09 16:58 . 2011-01-09 16:58 -------- d-----w- c:\windows\system32\GroupPolicy

2011-01-09 12:48 . 2008-11-10 16:41 32656 ----a-w- c:\windows\system32\msonpmon.dll

2011-01-09 12:48 . 2006-10-27 00:56 33104 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\msonpppr.dll

2011-01-09 12:47 . 2011-01-09 14:34 -------- d-----w- c:\program files\Microsoft Works

2011-01-09 12:46 . 2011-01-09 12:46 -------- d-----w- c:\program files\Microsoft.NET

2011-01-09 12:45 . 2011-01-09 12:45 -------- d-----w- c:\program files\Microsoft Visual Studio 8

2011-01-09 12:44 . 2011-01-09 12:47 -------- d-----w- c:\windows\SHELLNEW

2011-01-09 12:44 . 2011-01-14 12:38 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help

2011-01-09 12:43 . 2011-01-09 12:43 -------- d-----r- C:\MSOCache

2011-01-09 02:36 . 2011-01-09 02:36 -------- d-----w- c:\documents and settings\All Users\Application Data\LightScribe

2011-01-09 02:08 . 2011-01-09 02:08 -------- d-----w- c:\program files\Common Files\Nova Development

2011-01-09 02:08 . 2011-01-09 02:08 -------- d-----w- c:\program files\Creative Home

2011-01-09 02:03 . 2011-01-09 02:03 -------- d-----w- c:\program files\Common Files\Adobe

2011-01-09 02:02 . 2011-01-09 02:02 -------- d-----w- c:\program files\Common Files\Adobe AIR

2011-01-08 20:23 . 2011-01-08 20:23 -------- d-----w- c:\program files\Microsoft Money

2011-01-08 18:33 . 2008-04-14 05:15 60032 -c--a-w- c:\windows\system32\dllcache\usbaudio.sys

2011-01-08 18:33 . 2008-04-14 05:15 60032 ----a-w- c:\windows\system32\drivers\USBAUDIO.sys

2011-01-08 18:32 . 2008-04-14 10:42 20992 ----a-w- c:\windows\system32\dshowext.ax

2011-01-08 18:32 . 2008-04-14 05:16 121984 -c--a-w- c:\windows\system32\dllcache\usbvideo.sys

2011-01-08 18:32 . 2008-04-14 05:16 121984 ----a-w- c:\windows\system32\drivers\usbvideo.sys

2011-01-07 23:58 . 2011-01-07 23:58 -------- d-----w- C:\EPSONREG

2011-01-07 23:54 . 2001-05-31 19:49 126976 ----a-w- c:\windows\system32\lwf214p.dll

2011-01-07 23:53 . 2011-01-07 23:53 -------- d-----w- c:\program files\ACD Systems

2011-01-07 23:53 . 2001-05-31 19:49 317952 ----a-w- c:\windows\system32\Roboex32.dll

2011-01-07 23:53 . 2001-05-31 19:49 335872 ----a-w- c:\windows\system32\ldf252.dll

2011-01-07 23:53 . 2001-05-31 19:49 7168 ----a-w- c:\windows\system32\Jgme500.dll

2011-01-07 23:53 . 2001-05-31 19:49 15872 ----a-w- c:\windows\system32\Jgpl500.dll

2011-01-07 23:53 . 2001-05-31 19:49 144896 ----a-w- c:\windows\system32\Jgdw500.dll

2011-01-07 23:53 . 2001-05-31 19:49 13312 ----a-w- c:\windows\system32\Jgst500.dll

2011-01-07 23:53 . 2001-05-31 19:49 11264 ----a-w- c:\windows\system32\Jgid500.dll

2011-01-07 23:53 . 2001-05-31 19:49 11264 ----a-w- c:\windows\system32\Jgar500.dll

2011-01-07 23:52 . 2001-10-25 14:55 225280 ----a-w- c:\windows\system32\HpWiaDig.dll

2011-01-07 23:52 . 2001-10-25 14:55 212992 ----a-w- c:\windows\system32\HpWiaBtz.dll

2011-01-07 23:52 . 2001-10-25 14:55 225280 ----a-w- c:\windows\system32\HpWiaPtp.dll

2011-01-07 23:52 . 2011-01-07 23:52 -------- d-----w- c:\program files\Hewlett-Packard

2011-01-07 23:52 . 2001-08-08 19:48 306947 ----a-w- c:\windows\IsUninst.exe

2011-01-07 23:50 . 2011-01-07 23:50 -------- d-----w- c:\program files\hp photosmart

2011-01-07 23:48 . 2009-08-07 00:23 274288 ----a-w- c:\windows\system32\mucltui.dll

2011-01-07 23:44 . 2011-01-07 23:44 -------- d-----w- c:\documents and settings\All Users\Application Data\WEBREG

2011-01-07 23:43 . 2009-09-15 19:33 123904 ----a-w- c:\windows\system32\hpf3l101.dll

2011-01-07 23:43 . 2009-09-15 19:33 317440 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\hpfpp101.dll

2011-01-07 23:43 . 2009-09-14 21:58 451712 ----a-r- c:\windows\system32\hpzids01.dll

2011-01-07 23:42 . 2009-09-15 05:09 966656 ----a-r- c:\windows\system32\hpost_p03b.dll

2011-01-07 23:42 . 2009-09-15 05:09 885760 ----a-r- c:\windows\system32\hposwia_p03b.dll

2011-01-07 23:42 . 2009-09-15 05:09 315392 ----a-r- c:\windows\system32\hposc_p03a.dll

2011-01-07 23:42 . 2008-10-28 09:27 372736 ----a-r- c:\windows\system32\hppldcoi.dll

2011-01-07 23:42 . 2008-10-28 09:27 309760 ----a-r- c:\windows\system32\difxapi.dll

2011-01-07 23:42 . 2001-08-17 18:53 6784 -c--a-w- c:\windows\system32\dllcache\serscan.sys

2011-01-07 23:42 . 2001-08-17 18:53 6784 ----a-w- c:\windows\system32\drivers\serscan.sys

2011-01-07 23:41 . 2011-01-09 01:58 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo! Companion

2011-01-07 23:41 . 2011-01-07 23:41 -------- d-----w- c:\program files\Yahoo!

2011-01-07 23:41 . 2011-01-07 23:41 -------- d-----w- c:\windows\Cache

2011-01-07 23:41 . 2011-01-07 23:41 -------- d-----w- c:\program files\Coupons

2011-01-07 23:41 . 2011-01-07 23:41 -------- d-----w- c:\program files\HP Photo Creations

2011-01-07 23:41 . 2011-01-07 23:41 -------- d-----w- c:\documents and settings\All Users\Application Data\HP Photo Creations

2011-01-07 23:40 . 2011-01-07 23:40 -------- d-----w- c:\documents and settings\All Users\Application Data\HP Product Assistant

2011-01-07 23:39 . 2011-01-07 23:39 -------- d-----w- c:\program files\Common Files\HP

2011-01-07 23:39 . 2011-01-07 23:39 -------- d-----w- c:\program files\Common Files\Hewlett-Packard

2011-01-07 23:39 . 2011-01-07 23:44 -------- d-----w- c:\documents and settings\All Users\Application Data\HP

2011-01-07 23:37 . 2008-04-14 05:15 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys

2011-01-07 23:37 . 2008-04-14 05:15 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys

2011-01-07 23:37 . 2008-04-14 05:17 25856 -c--a-w- c:\windows\system32\dllcache\usbprint.sys

2011-01-07 23:37 . 2008-04-14 05:17 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys

2011-01-07 23:37 . 2008-04-14 05:15 32128 -c--a-w- c:\windows\system32\dllcache\usbccgp.sys

2011-01-07 23:37 . 2008-04-14 05:15 32128 ----a-w- c:\windows\system32\drivers\usbccgp.sys

2011-01-07 23:37 . 2011-01-07 23:44 -------- d-----w- c:\program files\HP

2011-01-07 23:23 . 2011-01-07 23:30 -------- d-----w- c:\program files\Common Files\Symantec Shared

2011-01-07 23:23 . 2011-01-07 23:23 60808 ----a-w- c:\windows\system32\S32EVNT1.DLL

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-11-29 22:38 . 2010-11-29 22:38 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx

2010-11-29 22:38 . 2010-11-29 22:38 69632 ----a-w- c:\windows\system32\QuickTime.qts

2010-11-09 14:52 . 2008-04-14 09:42 249856 ----a-w- c:\windows\system32\odbc32.dll

2001-08-23 12:00 94784 --sh--w- c:\windows\twain.dll

2008-04-14 09:42 50688 --sh--w- c:\windows\twain_32.dll

2010-09-18 06:53 974848 --sh--w- c:\windows\system32\mfc42.dll

2008-04-14 09:42 57344 --sh--w- c:\windows\system32\msvcirt.dll

2008-04-14 09:42 413696 --sh--w- c:\windows\system32\msvcp60.dll

2008-04-14 09:42 551936 --sh--w- c:\windows\system32\oleaut32.dll

2008-04-14 09:42 11776 --sh--w- c:\windows\system32\regsvr32.exe

.

((((((((((((((((((((((((((((( SnapShot@2011-01-18_14.16.01 )))))))))))))))))))))))))))))))))))))))))

.

+ 2007-11-07 06:19 . 2007-11-07 06:19 46592 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_11f3ea3a\mfc90kor.dll

+ 2007-11-07 06:19 . 2007-11-07 06:19 47104 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_11f3ea3a\mfc90jpn.dll

+ 2007-11-07 06:19 . 2007-11-07 06:19 59392 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_11f3ea3a\mfc90ita.dll

+ 2007-11-07 06:19 . 2007-11-07 06:19 60416 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_11f3ea3a\mfc90fra.dll

+ 2007-11-07 06:19 . 2007-11-07 06:19 59392 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_11f3ea3a\mfc90esp.dll

+ 2007-11-07 06:19 . 2007-11-07 06:19 59392 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_11f3ea3a\mfc90esn.dll

+ 2007-11-07 06:19 . 2007-11-07 06:19 54272 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_11f3ea3a\mfc90enu.dll

+ 2007-11-07 06:19 . 2007-11-07 06:19 60928 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_11f3ea3a\mfc90deu.dll

+ 2007-11-07 06:19 . 2007-11-07 06:19 41984 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_11f3ea3a\mfc90cht.dll

+ 2007-11-07 06:19 . 2007-11-07 06:19 41472 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_11f3ea3a\mfc90chs.dll

+ 2007-11-07 03:51 . 2007-11-07 03:51 80896 c:\windows\WinSxS\x86_Microsoft.VC90.DebugMFC_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_2a62a75b\mfcm90ud.dll

+ 2007-11-07 03:51 . 2007-11-07 03:51 80896 c:\windows\WinSxS\x86_Microsoft.VC90.DebugMFC_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_2a62a75b\mfcm90d.dll

+ 2006-12-02 05:46 . 2006-12-02 05:46 65536 c:\windows\WinSxS\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6c18549a\vcomp.dll

+ 2011-02-05 20:06 . 2011-02-05 20:06 16384 c:\windows\Temp\Perflib_Perfdata_704.dat

+ 2011-02-05 20:07 . 2011-02-05 20:07 16384 c:\windows\Temp\Perflib_Perfdata_29c.dat

+ 2011-01-18 14:31 . 2008-04-14 04:09 14592 c:\windows\system32\ReinstallBackups\0003\DriverFiles\i386\kbdhid.sys

+ 2011-01-18 14:31 . 2008-04-14 04:09 24576 c:\windows\system32\ReinstallBackups\0003\DriverFiles\i386\kbdclass.sys

+ 2011-01-18 14:31 . 2001-08-23 12:00 12160 c:\windows\system32\ReinstallBackups\0002\DriverFiles\i386\mouhid.sys

+ 2011-01-18 14:31 . 2008-04-14 09:51 23040 c:\windows\system32\ReinstallBackups\0002\DriverFiles\i386\mouclass.sys

+ 2011-01-18 14:32 . 2008-04-14 10:41 28160 c:\windows\system32\irmon.dll

+ 2011-01-30 16:25 . 2010-09-28 20:44 41984 c:\windows\system32\DRVSTORE\usbaapl_A4C70B47551C2629A145AE032C4D1823570ADB7B\usbaapl.sys

+ 2011-01-30 16:25 . 2010-04-20 01:29 18432 c:\windows\system32\DRVSTORE\netaapl_8A27A03003759CB01567E831096473C330131D64\netaapl.sys

+ 2006-11-02 12:22 . 2006-11-02 12:22 32224 c:\windows\system32\drivers\wdfldr.sys

+ 2011-01-18 14:32 . 2008-04-14 05:16 59136 c:\windows\system32\drivers\rfcomm.sys

+ 2001-08-17 13:48 . 2001-08-17 18:48 12160 c:\windows\system32\drivers\mouhid.sys

- 2001-08-17 13:48 . 2001-08-23 12:00 12160 c:\windows\system32\drivers\mouhid.sys

- 2008-04-14 00:09 . 2008-04-14 09:51 23040 c:\windows\system32\drivers\mouclass.sys

+ 2008-04-14 00:09 . 2008-04-14 05:09 23040 c:\windows\system32\drivers\mouclass.sys

+ 2009-06-17 16:56 . 2009-06-17 16:56 37392 c:\windows\system32\drivers\LMouFilt.Sys

+ 2009-06-17 16:56 . 2009-06-17 16:56 35472 c:\windows\system32\drivers\LHidFilt.Sys

- 2008-04-14 04:09 . 2008-04-14 04:09 14592 c:\windows\system32\drivers\kbdhid.sys

+ 2008-04-14 04:09 . 2008-04-14 05:09 14592 c:\windows\system32\drivers\kbdhid.sys

+ 2008-04-14 04:09 . 2008-04-14 05:09 24576 c:\windows\system32\drivers\kbdclass.sys

- 2008-04-14 04:09 . 2008-04-14 04:09 24576 c:\windows\system32\drivers\kbdclass.sys

+ 2011-01-18 14:32 . 2008-04-14 05:16 25600 c:\windows\system32\drivers\hidbth.sys

+ 2011-01-18 14:32 . 2008-04-14 05:16 18944 c:\windows\system32\drivers\BTHUSB.SYS

+ 2011-01-18 14:32 . 2008-04-14 05:16 17024 c:\windows\system32\drivers\BthEnum.sys

+ 2011-01-18 14:32 . 2008-04-14 05:16 59136 c:\windows\system32\dllcache\rfcomm.sys

+ 2001-08-17 13:48 . 2001-08-17 18:48 12160 c:\windows\system32\dllcache\mouhid.sys

+ 2008-04-14 00:09 . 2008-04-14 05:09 23040 c:\windows\system32\dllcache\mouclass.sys

+ 2008-04-14 04:09 . 2008-04-14 05:09 14592 c:\windows\system32\dllcache\kbdhid.sys

+ 2008-04-14 04:09 . 2008-04-14 05:09 24576 c:\windows\system32\dllcache\kbdclass.sys

+ 2011-01-18 14:32 . 2008-04-14 10:41 28160 c:\windows\system32\dllcache\irmon.dll

+ 2011-01-18 14:32 . 2008-04-14 05:16 25600 c:\windows\system32\dllcache\hidbth.sys

+ 2011-01-18 14:32 . 2008-04-14 05:16 18944 c:\windows\system32\dllcache\bthusb.sys

+ 2011-01-18 14:32 . 2008-04-14 05:16 17024 c:\windows\system32\dllcache\bthenum.sys

+ 2011-01-06 23:18 . 2011-01-22 17:27 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat

- 2011-01-06 23:18 . 2011-01-15 17:26 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat

- 2011-01-06 23:18 . 2011-01-15 17:26 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat

+ 2011-01-06 23:18 . 2011-01-22 17:27 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat

+ 2011-01-15 17:26 . 2011-01-22 17:27 16384 c:\windows\system32\config\systemprofile\IETldCache\index.dat

- 2011-01-15 17:26 . 2011-01-15 17:26 16384 c:\windows\system32\config\systemprofile\IETldCache\index.dat

- 2011-01-15 17:26 . 2011-01-15 17:26 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat

+ 2011-01-18 14:35 . 2011-01-22 17:27 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat

+ 2006-11-13 18:38 . 2006-11-13 18:38 22824 c:\windows\system32\ceutil.dll

+ 2009-06-17 16:55 . 2009-06-17 16:55 55824 c:\windows\KHALMNPR.Exe

+ 2011-01-18 14:31 . 2011-01-18 14:31 10134 c:\windows\Installer\{A498D9EB-927B-459B-85D6-DD6EF8C2C564}\ARPPRODUCTICON.exe

+ 2011-01-18 14:41 . 2011-01-18 14:41 22486 c:\windows\Installer\{99052DB7-9592-4522-A558-5417BBAD48EE}\WCESMgrIcon.exe

+ 2011-01-18 14:41 . 2011-01-18 14:41 22486 c:\windows\Installer\{99052DB7-9592-4522-A558-5417BBAD48EE}\ARPPRODUCTICON.exe

+ 2011-01-22 17:33 . 2011-01-22 17:33 40960 c:\windows\Installer\{5FE545A1-D215-4216-9189-E7B39C9D1CC1}\QuickenOLBackupLaunc_0D2E80C8087543EB962347118E2DFBCA.exe

+ 2011-01-22 17:33 . 2011-01-22 17:33 40960 c:\windows\Installer\{5FE545A1-D215-4216-9189-E7B39C9D1CC1}\NewShortcut7_E715633012F6421883A4BCE59058C2A8.exe

+ 2011-01-22 17:33 . 2011-01-22 17:33 98304 c:\windows\Installer\{5FE545A1-D215-4216-9189-E7B39C9D1CC1}\NewShortcut1_E715633012F6421883A4BCE59058C2A8.exe

+ 2011-01-22 17:33 . 2011-01-22 17:33 98304 c:\windows\Installer\{5FE545A1-D215-4216-9189-E7B39C9D1CC1}\ARPPRODUCTICON.exe

+ 2011-01-18 14:30 . 2011-01-18 14:30 10134 c:\windows\Installer\{3101CB58-3482-4D21-AF1A-7057FC935355}\ARPPRODUCTICON.exe

+ 2011-01-18 14:31 . 2011-01-18 14:31 10134 c:\windows\Installer\{0C826C5B-B131-423A-A229-C71B3CACCD6A}\ARPPRODUCTICON.exe

+ 2011-01-18 14:32 . 2008-04-14 10:42 8192 c:\windows\system32\wshirda.dll

+ 2011-01-18 14:32 . 2008-04-14 10:42 8192 c:\windows\system32\dllcache\wshirda.dll

+ 2007-11-07 06:19 . 2007-11-07 06:19 868864 c:\windows\WinSxS\x86_Microsoft.VC90.DebugCRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_597c3456\msvcp90d.dll

+ 2007-11-07 01:24 . 2007-11-07 01:24 311808 c:\windows\WinSxS\x86_Microsoft.VC90.DebugCRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_597c3456\msvcm90d.dll

+ 2008-04-14 09:42 . 2010-08-31 23:43 127320 c:\windows\system32\xmllite.dll

+ 2011-01-22 17:34 . 2010-08-31 23:43 419904 c:\windows\system32\spool\drivers\w32x86\acpdfui400.dll

+ 2011-01-22 17:34 . 2010-08-31 23:43 733696 c:\windows\system32\spool\drivers\w32x86\acpdf400.dll

+ 2011-01-22 17:34 . 2010-08-31 23:43 419904 c:\windows\system32\spool\drivers\w32x86\3\acpdfui400.dll

+ 2011-01-22 17:34 . 2010-08-31 23:43 733696 c:\windows\system32\spool\drivers\w32x86\3\acpdf400.dll

+ 2006-11-13 18:39 . 2006-11-13 18:39 138024 c:\windows\system32\rapi.dll

+ 2011-01-18 14:32 . 2008-04-14 10:42 151552 c:\windows\system32\irftp.exe

+ 2006-11-02 12:22 . 2006-11-02 12:22 492000 c:\windows\system32\drivers\wdf01000.sys

+ 2011-01-18 14:32 . 2008-04-14 05:21 101120 c:\windows\system32\drivers\bthpan.sys

+ 2011-01-18 14:32 . 2008-04-14 10:42 151552 c:\windows\system32\dllcache\irftp.exe

+ 2011-01-18 14:32 . 2008-04-14 05:21 101120 c:\windows\system32\dllcache\bthpan.sys

+ 2011-01-18 14:41 . 2011-01-18 14:41 912384 c:\windows\Installer\7a7db.msi

+ 2011-01-18 14:31 . 2011-01-18 14:31 193536 c:\windows\Installer\7a7d7.msi

+ 2011-01-18 14:31 . 2011-01-18 14:31 331264 c:\windows\Installer\7a7cd.msi

+ 2011-01-30 16:28 . 2011-01-30 16:28 380928 c:\windows\Installer\{AAD47011-8518-4608-9656-951DA35B587B}\iTunesIco.exe

+ 2007-11-07 06:19 . 2007-11-07 06:19 2399744 c:\windows\WinSxS\x86_Microsoft.VC90.DebugMFC_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_2a62a75b\mfc90ud.dll

+ 2007-11-07 06:19 . 2007-11-07 06:19 2372088 c:\windows\WinSxS\x86_Microsoft.VC90.DebugMFC_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_2a62a75b\mfc90d.dll

+ 2007-11-07 06:19 . 2007-11-07 06:19 1180672 c:\windows\WinSxS\x86_Microsoft.VC90.DebugCRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_597c3456\msvcr90d.dll

+ 2006-11-02 16:09 . 2006-11-02 16:09 1419232 c:\windows\system32\WdfCoInstaller01005.dll

+ 2011-01-22 17:34 . 2010-08-31 23:43 4199768 c:\windows\system32\spool\drivers\w32x86\cdintf400.dll

+ 2010-08-31 23:43 . 2010-08-31 23:43 1721768 c:\windows\system32\inetclnt.dll

+ 2011-01-30 16:25 . 2010-09-28 20:44 4184352 c:\windows\system32\DRVSTORE\usbaapl_A4C70B47551C2629A145AE032C4D1823570ADB7B\usbaaplrc.dll

+ 2011-01-30 16:25 . 2010-04-20 01:29 1461992 c:\windows\system32\DRVSTORE\netaapl_8A27A03003759CB01567E831096473C330131D64\wdfcoinstaller01009.dll

+ 2011-01-30 16:28 . 2011-01-30 16:28 6596096 c:\windows\Installer\9f5bdc.msi

+ 2011-01-30 16:25 . 2011-01-30 16:25 3085312 c:\windows\Installer\9f52e9.msi

+ 2011-01-18 14:31 . 2011-01-18 14:31 3225600 c:\windows\Installer\7a7c3.msi

+ 2011-01-18 14:30 . 2011-01-18 14:30 2715648 c:\windows\Installer\7a7b8.msi

+ 2011-02-05 19:25 . 2011-02-05 19:25 1094656 c:\windows\Installer\18462f.msi

+ 2011-01-22 17:33 . 2011-01-22 17:33 4862976 c:\windows\Installer\14c08a.msi

.

-- Snapshot reset to current date --

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Creative Detector"="c:\program files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 102400]

"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2009-06-17 2363392]

"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Bluetooth Connection Assistant"="LBTWIZ.EXE -silent" [X]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-12-19 7315456]

"nwiz"="nwiz.exe" [2005-12-19 1519616]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2005-12-19 86016]

"CTDVDDET"="c:\program files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE" [2003-06-18 45056]

"RCSystem"="c:\program files\Creative\Shared Files\Module Loader\DLLML.exe" [2005-06-16 49152]

"AudioDrvEmulator"="c:\program files\Creative\Shared Files\Module Loader\DLLML.exe" [2005-06-16 49152]

"VolPanel"="c:\program files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe" [2005-07-11 122880]

"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]

"NBAgent"="c:\program files\Nero\Nero 10\Nero BackItUp\NBAgent.exe" [2010-10-28 1406248]

"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2009-11-18 54576]

"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb04.exe" [2001-10-25 196608]

"HPHmon03"="c:\windows\system32\hphmon03.exe" [2001-10-25 311296]

"CXMon"="c:\program files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe" [2001-09-19 45056]

"Share-to-Web Namespace Daemon"="c:\program files\Hewlett-Packard\PhotoSmart\HP Share-to-Web\hpgs2wnd.exe" [2001-07-03 57344]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]

"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]

"CTxfiHlp"="CTXFIHLP.EXE" [2009-06-04 25600]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-11-29 421888]

"CTHelper"="CTHELPER.EXE" [2005-08-07 16384]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2009-06-17 55824]

"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-01-25 421160]

c:\documents and settings\Teresa\Start Menu\Programs\Startup\

Logitech . Product Registration.lnk - c:\program files\Common Files\Logishrd\eReg\SetPoint\eReg.exe [2008-11-7 517384]

OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

AutoStart IR.lnk - c:\program files\WinTV\Ir.exe [2011-1-6 106551]

Event Planner Reminder.lnk - c:\program files\Creative Home\Hallmark Card Studio 2011 Deluxe\Planner\PLNRnote.exe [2010-12-13 360448]

HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-11-18 275072]

Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2011-1-18 813584]

Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableLinkedConnections"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]

2009-07-20 17:28 72208 ----a-w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]

@=""

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ASUS WiFi-AP Solo.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\ASUS WiFi-AP Solo.lnk

backup=c:\windows\pss\ASUS WiFi-AP Solo.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Teresa^Start Menu^Programs^Startup^TitanTV Remote Scheduler.lnk]

path=c:\documents and settings\Teresa\Start Menu\Programs\Startup\TitanTV Remote Scheduler.lnk

backup=c:\windows\pss\TitanTV Remote Scheduler.lnkStartup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfcCopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgplgtupl.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgpc01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgm.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgh.exe"=

"c:\\Program Files\\HP\\HP Software Update\\hpwucli.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\smart web printing\\SmartWebPrintExe.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=

"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager

"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager

"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application

"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [1/9/2011 4:55 PM 64288]

R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NIS\1205000.07D\symds.sys [1/7/2011 6:25 PM 340016]

R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NIS\1205000.07D\symefa.sys [1/7/2011 6:25 PM 652336]

R1 BHDrvx86;BHDrvx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20110114.001\BHDrvx86.sys [1/18/2011 8:56 PM 691248]

R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NIS\1205000.07D\ironx86.sys [1/7/2011 6:25 PM 136312]

R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [12/3/2010 4:05 AM 1402272]

R2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [1/18/2011 9:31 AM 10384]

R2 NAUpdate;@c:\program files\Nero\Update\NASvc.exe,-200;c:\program files\Nero\Update\NASvc.exe [5/4/2010 12:07 PM 503080]

R2 NIS;Norton Internet Security;c:\program files\Norton Internet Security\Engine\18.5.0.125\ccsvchst.exe [1/7/2011 6:25 PM 130000]

R3 CT20XUT.SYS;CT20XUT.SYS;c:\windows\system32\drivers\CT20XUT.sys [6/4/2009 2:46 AM 171032]

R3 CTEXFIFX.SYS;CTEXFIFX.SYS;c:\windows\system32\drivers\CTEXFIFX.sys [6/4/2009 2:46 AM 1324056]

R3 CTHWIUT.SYS;CTHWIUT.SYS;c:\windows\system32\drivers\CTHWIUT.sys [6/4/2009 2:46 AM 72728]

R3 Dot4Usb HPH09;Dot4Usb HPH09;c:\windows\system32\drivers\hphius09.sys [10/25/2001 9:54 AM 18864]

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [1/7/2011 6:25 PM 102448]

R3 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20110204.001\IDSXpx86.sys [2/5/2011 2:20 PM 341944]

R3 RTLWUSB;Realtek RTL8187 Wireless 802.11g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\drivers\RTL8187.sys [1/6/2011 6:27 PM 176128]

S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [1/9/2011 12:58 PM 79360]

S3 CT20XUT;CT20XUT;c:\windows\system32\drivers\CT20XUT.sys [6/4/2009 2:46 AM 171032]

S3 CTEXFIFX;CTEXFIFX;c:\windows\system32\drivers\CTEXFIFX.sys [6/4/2009 2:46 AM 1324056]

S3 CTHWIUT;CTHWIUT;c:\windows\system32\drivers\CTHWIUT.sys [6/4/2009 2:46 AM 72728]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

HPService REG_MULTI_SZ HPSLPSVC

hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]

2009-06-17 17:11 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe

.

Contents of the 'Scheduled Tasks' folder

2011-02-05 c:\windows\Tasks\Ad-Aware Update (Weekly).job

- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2010-12-03 09:04]

2011-02-02 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 16:50]

.

------- Supplementary Scan -------

.

uInternet Settings,ProxyOverride = *.local

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000

LSP: %SYSTEMROOT%\system32\nvappfilter.dll

DPF: {0067DBFC-A752-458C-AE6E-B9C7E63D4824} - hxxp://www.logitech.com/devicedetector/plugins/LogitechDeviceDetection32.cab

DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} - hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2011-02-05 15:14

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

CTxfiHlp = CTXFIHLP.EXE?

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NIS]

"ImagePath"="\"c:\program files\Norton Internet Security\Engine\18.5.0.125\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files\Norton Internet Security\Engine\18.5.0.125\diMaster.dll\" /prefetch:1"

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@DACL=(02 0010)

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@DACL=(02 0010)

@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@DACL=(02 0010)

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1044)

c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll

c:\program files\common files\logishrd\bluetooth\LBTServ.dll

- - - - - - - > 'lsass.exe'(1116)

c:\windows\system32\nvappfilter.dll

.

Completion time: 2011-02-05 15:16:08

ComboFix-quarantined-files.txt 2011-02-05 20:16

ComboFix2.txt 2011-01-18 14:17

ComboFix3.txt 2011-01-11 02:06

Pre-Run: 133,437,169,664 bytes free

Post-Run: 133,776,433,152 bytes free

- - End Of File - - E69B14DAA993CCB916F25837183B94AB

and...

2011/02/05 14:54:44.0247 1884 TDSS rootkit removing tool 2.4.16.0 Feb 1 2011 10:34:03

2011/02/05 14:54:44.0763 1884 ================================================================================

2011/02/05 14:54:44.0763 1884 SystemInfo:

2011/02/05 14:54:44.0763 1884

2011/02/05 14:54:44.0763 1884 OS Version: 5.1.2600 ServicePack: 3.0

2011/02/05 14:54:44.0763 1884 Product type: Workstation

2011/02/05 14:54:44.0763 1884 ComputerName: BABY

2011/02/05 14:54:44.0763 1884 UserName: Teresa

2011/02/05 14:54:44.0763 1884 Windows directory: C:\WINDOWS

2011/02/05 14:54:44.0763 1884 System windows directory: C:\WINDOWS

2011/02/05 14:54:44.0763 1884 Processor architecture: Intel x86

2011/02/05 14:54:44.0763 1884 Number of processors: 2

2011/02/05 14:54:44.0763 1884 Page size: 0x1000

2011/02/05 14:54:44.0763 1884 Boot type: Normal boot

2011/02/05 14:54:44.0763 1884 ================================================================================

2011/02/05 14:54:45.0450 1884 Initialize success

2011/02/05 14:55:30.0200 4380 ================================================================================

2011/02/05 14:55:30.0200 4380 Scan started

2011/02/05 14:55:30.0200 4380 Mode: Manual;

2011/02/05 14:55:30.0200 4380 ================================================================================

2011/02/05 14:55:30.0419 4380 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys

2011/02/05 14:55:30.0450 4380 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys

2011/02/05 14:55:30.0482 4380 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys

2011/02/05 14:55:30.0513 4380 AegisP (30bb1bde595ca65fd5549462080d94e5) C:\WINDOWS\system32\DRIVERS\AegisP.sys

2011/02/05 14:55:30.0560 4380 AFD (7e775010ef291da96ad17ca4b17137d7) C:\WINDOWS\System32\drivers\afd.sys

2011/02/05 14:55:30.0654 4380 AmdK8 (0a4d13b388c814560bd69c3a496ecfa8) C:\WINDOWS\system32\DRIVERS\AmdK8.sys

2011/02/05 14:55:30.0763 4380 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys

2011/02/05 14:55:30.0779 4380 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys

2011/02/05 14:55:30.0825 4380 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys

2011/02/05 14:55:30.0857 4380 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys

2011/02/05 14:55:30.0904 4380 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys

2011/02/05 14:55:30.0966 4380 BHDrvx86 (83a2fec59a0a0fc73bf6598e901b2fbd) C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20110114.001\BHDrvx86.sys

2011/02/05 14:55:31.0029 4380 BthEnum (b279426e3c0c344893ed78a613a73bde) C:\WINDOWS\system32\DRIVERS\BthEnum.sys

2011/02/05 14:55:31.0060 4380 BthPan (80602b8746d3738f5886ce3d67ef06b6) C:\WINDOWS\system32\DRIVERS\bthpan.sys

2011/02/05 14:55:31.0091 4380 BTHPORT (662bfd909447dd9cc15b1a1c366583b4) C:\WINDOWS\system32\Drivers\BTHport.sys

2011/02/05 14:55:31.0122 4380 BTHUSB (61364cd71ef63b0f038b7e9df00f1efa) C:\WINDOWS\system32\Drivers\BTHUSB.sys

2011/02/05 14:55:31.0216 4380 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys

2011/02/05 14:55:31.0247 4380 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys

2011/02/05 14:55:31.0279 4380 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys

2011/02/05 14:55:31.0294 4380 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys

2011/02/05 14:55:31.0341 4380 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys

2011/02/05 14:55:31.0450 4380 CT20XUT (134cdd242af1ae9961f065fba3508a7b) C:\WINDOWS\system32\drivers\CT20XUT.SYS

2011/02/05 14:55:31.0466 4380 CT20XUT.SYS (134cdd242af1ae9961f065fba3508a7b) C:\WINDOWS\System32\drivers\CT20XUT.SYS

2011/02/05 14:55:31.0497 4380 ctac32k (93439baf09ce3c6d4ce55da5b07d1b6a) C:\WINDOWS\system32\drivers\ctac32k.sys

2011/02/05 14:55:31.0513 4380 ctaud2k (6ab74512f09d673452d63ddec9014db5) C:\WINDOWS\system32\drivers\ctaud2k.sys

2011/02/05 14:55:31.0560 4380 ctdvda2k (788db5d99b2ca44ff61d8ed7b3c67c2e) C:\WINDOWS\system32\drivers\ctdvda2k.sys

2011/02/05 14:55:31.0591 4380 CTEXFIFX (3a9ad039d94be8d955ad0b2cb207378d) C:\WINDOWS\system32\drivers\CTEXFIFX.SYS

2011/02/05 14:55:31.0638 4380 CTEXFIFX.SYS (3a9ad039d94be8d955ad0b2cb207378d) C:\WINDOWS\System32\drivers\CTEXFIFX.SYS

2011/02/05 14:55:31.0654 4380 CTHWIUT (4602ad8c8e1b285e1a23a957f487da86) C:\WINDOWS\system32\drivers\CTHWIUT.SYS

2011/02/05 14:55:31.0669 4380 CTHWIUT.SYS (4602ad8c8e1b285e1a23a957f487da86) C:\WINDOWS\System32\drivers\CTHWIUT.SYS

2011/02/05 14:55:31.0685 4380 ctprxy2k (d42b84671f2193330215d3c375a2e948) C:\WINDOWS\system32\drivers\ctprxy2k.sys

2011/02/05 14:55:31.0700 4380 ctsfm2k (974cfcbe3206367bec1d527d9dade998) C:\WINDOWS\system32\drivers\ctsfm2k.sys

2011/02/05 14:55:31.0747 4380 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys

2011/02/05 14:55:31.0794 4380 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys

2011/02/05 14:55:31.0810 4380 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys

2011/02/05 14:55:31.0841 4380 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys

2011/02/05 14:55:31.0872 4380 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys

2011/02/05 14:55:31.0919 4380 Dot4 HPH09 (ad4bf19f18e56e9cc23b02b53321336e) C:\WINDOWS\system32\DRIVERS\hphid409.sys

2011/02/05 14:55:31.0919 4380 Dot4Print HPH09 (81ac4ae8ff949bf5924b5ee00d5ac90b) C:\WINDOWS\system32\DRIVERS\hphipr09.sys

2011/02/05 14:55:31.0935 4380 Dot4Storage HPH09 (47b5fd84ca8d16060c4e59647d80c0ca) C:\WINDOWS\system32\Drivers\hphs2k09.sys

2011/02/05 14:55:31.0966 4380 Dot4Usb HPH09 (eb20c76c39917b1641bb4c5206be7d76) C:\WINDOWS\system32\drivers\hphius09.sys

2011/02/05 14:55:31.0997 4380 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys

2011/02/05 14:55:32.0044 4380 eeCtrl (089296aedb9b72b4916ac959752bdc89) C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys

2011/02/05 14:55:32.0075 4380 emupia (04afe5c11777e33178ec11e1fac47b07) C:\WINDOWS\system32\drivers\emupia2k.sys

2011/02/05 14:55:32.0091 4380 EraserUtilRebootDrv (850259334652d392e33ee3412562e583) C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys

2011/02/05 14:55:32.0122 4380 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys

2011/02/05 14:55:32.0138 4380 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys

2011/02/05 14:55:32.0169 4380 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys

2011/02/05 14:55:32.0185 4380 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys

2011/02/05 14:55:32.0200 4380 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\DRIVERS\fltMgr.sys

2011/02/05 14:55:32.0232 4380 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys

2011/02/05 14:55:32.0247 4380 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys

2011/02/05 14:55:32.0279 4380 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys

2011/02/05 14:55:32.0325 4380 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys

2011/02/05 14:55:32.0388 4380 ha20x2k (41fce1833d8f659acc56cb0ee43b2ced) C:\WINDOWS\system32\drivers\ha20x2k.sys

2011/02/05 14:55:32.0419 4380 hcwPVRP2 (fc7dcdef8f17d3c5decc880673ea5bd5) C:\WINDOWS\system32\DRIVERS\hcwPVRP2.sys

2011/02/05 14:55:32.0466 4380 HidBth (7bd2de4c85eb4241eed57672b16a7d8d) C:\WINDOWS\system32\DRIVERS\hidbth.sys

2011/02/05 14:55:32.0482 4380 hidusb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys

2011/02/05 14:55:32.0544 4380 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys

2011/02/05 14:55:32.0607 4380 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\drivers\i8042prt.sys

2011/02/05 14:55:32.0685 4380 IDSxpx86 (0308238c582a55d83d34feee39542793) C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20110204.001\IDSxpx86.sys

2011/02/05 14:55:32.0700 4380 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys

2011/02/05 14:55:32.0763 4380 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys

2011/02/05 14:55:32.0779 4380 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys

2011/02/05 14:55:32.0794 4380 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys

2011/02/05 14:55:32.0810 4380 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys

2011/02/05 14:55:32.0825 4380 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys

2011/02/05 14:55:32.0857 4380 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys

2011/02/05 14:55:32.0872 4380 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys

2011/02/05 14:55:32.0888 4380 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys

2011/02/05 14:55:32.0904 4380 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys

2011/02/05 14:55:32.0919 4380 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys

2011/02/05 14:55:32.0950 4380 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys

2011/02/05 14:55:32.0982 4380 Lbd (b7c19ec8b0dd7efa58ad41ffeb8b8cda) C:\WINDOWS\system32\DRIVERS\Lbd.sys

2011/02/05 14:55:32.0997 4380 LBeepKE (9ffd1cf2a782f2560e78eec4b8b8689e) C:\WINDOWS\system32\Drivers\LBeepKE.sys

2011/02/05 14:55:33.0044 4380 LHidFilt (7f9c7b28cf1c859e1c42619eea946dc8) C:\WINDOWS\system32\DRIVERS\LHidFilt.Sys

2011/02/05 14:55:33.0075 4380 LMouFilt (ab33792a87285344f43b5ce23421bab0) C:\WINDOWS\system32\DRIVERS\LMouFilt.Sys

2011/02/05 14:55:33.0091 4380 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys

2011/02/05 14:55:33.0122 4380 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys

2011/02/05 14:55:33.0122 4380 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys

2011/02/05 14:55:33.0138 4380 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys

2011/02/05 14:55:33.0169 4380 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys

2011/02/05 14:55:33.0200 4380 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys

2011/02/05 14:55:33.0216 4380 MRxSmb (f3aefb11abc521122b67095044169e98) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys

2011/02/05 14:55:33.0247 4380 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys

2011/02/05 14:55:33.0279 4380 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys

2011/02/05 14:55:33.0294 4380 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys

2011/02/05 14:55:33.0310 4380 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys

2011/02/05 14:55:33.0341 4380 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys

2011/02/05 14:55:33.0372 4380 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys

2011/02/05 14:55:33.0404 4380 MTsensor (d48659bb24c48345d926ecb45c1ebdf5) C:\WINDOWS\system32\DRIVERS\ASACPI.sys

2011/02/05 14:55:33.0404 4380 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys

2011/02/05 14:55:33.0435 4380 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys

2011/02/05 14:55:33.0497 4380 NAVENG (c8ef74e4d8105b1d02d58ea4734cf616) C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20110205.002\NAVENG.SYS

2011/02/05 14:55:33.0544 4380 NAVEX15 (94b3164055d821a62944d9fe84036470) C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20110205.002\NAVEX15.SYS

2011/02/05 14:55:33.0575 4380 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys

2011/02/05 14:55:33.0591 4380 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys

2011/02/05 14:55:33.0607 4380 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys

2011/02/05 14:55:33.0638 4380 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys

2011/02/05 14:55:33.0654 4380 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys

2011/02/05 14:55:33.0669 4380 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys

2011/02/05 14:55:33.0685 4380 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys

2011/02/05 14:55:33.0747 4380 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys

2011/02/05 14:55:33.0779 4380 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys

2011/02/05 14:55:33.0810 4380 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys

2011/02/05 14:55:33.0857 4380 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys

2011/02/05 14:55:33.0935 4380 nv (b78ae411b97cb198b1111b92ef1968ee) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys

2011/02/05 14:55:34.0013 4380 nvata (4d6c6b46b3edf6f2e219a86b61d104ae) C:\WINDOWS\system32\DRIVERS\nvata.sys

2011/02/05 14:55:34.0044 4380 NVENETFD (1b83b60541be1b6db81641c448007f21) C:\WINDOWS\system32\DRIVERS\NVENETFD.sys

2011/02/05 14:55:34.0060 4380 nvnetbus (57b669f9234604a350174b86764444b0) C:\WINDOWS\system32\DRIVERS\nvnetbus.sys

2011/02/05 14:55:34.0075 4380 NVTCP (c0e7437765a694328579c4674ef3ab20) C:\WINDOWS\system32\DRIVERS\NVTcp.sys

2011/02/05 14:55:34.0107 4380 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys

2011/02/05 14:55:34.0122 4380 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys

2011/02/05 14:55:34.0169 4380 ossrv (11b3328d84ed6c11baf4f4f115459ab6) C:\WINDOWS\system32\drivers\ctoss2k.sys

2011/02/05 14:55:34.0185 4380 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys

2011/02/05 14:55:34.0200 4380 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys

2011/02/05 14:55:34.0232 4380 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys

2011/02/05 14:55:34.0247 4380 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys

2011/02/05 14:55:34.0279 4380 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys

2011/02/05 14:55:34.0325 4380 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys

2011/02/05 14:55:34.0466 4380 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys

2011/02/05 14:55:34.0482 4380 Processor (a32bebaf723557681bfc6bd93e98bd26) C:\WINDOWS\system32\DRIVERS\processr.sys

2011/02/05 14:55:34.0529 4380 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys

2011/02/05 14:55:34.0544 4380 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys

2011/02/05 14:55:34.0654 4380 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys

2011/02/05 14:55:34.0669 4380 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys

2011/02/05 14:55:34.0700 4380 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys

2011/02/05 14:55:34.0716 4380 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys

2011/02/05 14:55:34.0747 4380 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys

2011/02/05 14:55:34.0763 4380 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys

2011/02/05 14:55:34.0794 4380 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys

2011/02/05 14:55:34.0825 4380 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys

2011/02/05 14:55:34.0857 4380 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys

2011/02/05 14:55:34.0888 4380 RFCOMM (851c30df2807fcfa21e4c681a7d6440e) C:\WINDOWS\system32\DRIVERS\rfcomm.sys

2011/02/05 14:55:34.0935 4380 RTLWUSB (05552e37b5c0b53b7e4b95a850447e85) C:\WINDOWS\system32\DRIVERS\RTL8187.sys

2011/02/05 14:55:34.0966 4380 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys

2011/02/05 14:55:34.0982 4380 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys

2011/02/05 14:55:35.0013 4380 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys

2011/02/05 14:55:35.0044 4380 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys

2011/02/05 14:55:35.0075 4380 SI3132 (9604998d0c578608151b6e59266fcae1) C:\WINDOWS\system32\DRIVERS\SI3132.sys

2011/02/05 14:55:35.0091 4380 SiFilter (72cf151fb410e544904dbc7d7f29b796) C:\WINDOWS\system32\DRIVERS\SiWinAcc.sys

2011/02/05 14:55:35.0138 4380 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys

2011/02/05 14:55:35.0185 4380 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys

2011/02/05 14:55:35.0200 4380 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys

2011/02/05 14:55:35.0247 4380 SRTSP (a7a104a61c4e30de9c58f8c372a5c209) C:\WINDOWS\System32\Drivers\NIS\1205000.07D\SRTSP.SYS

2011/02/05 14:55:35.0279 4380 SRTSPX (2833445f786bd000bb14c84a9d91347a) C:\WINDOWS\system32\drivers\NIS\1205000.07D\SRTSPX.SYS

2011/02/05 14:55:35.0310 4380 Srv (0f6aefad3641a657e18081f52d0c15af) C:\WINDOWS\system32\DRIVERS\srv.sys

2011/02/05 14:55:35.0341 4380 StillCam (a9573045baa16eab9b1085205b82f1ed) C:\WINDOWS\system32\DRIVERS\serscan.sys

2011/02/05 14:55:35.0372 4380 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys

2011/02/05 14:55:35.0388 4380 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys

2011/02/05 14:55:35.0419 4380 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys

2011/02/05 14:55:35.0497 4380 SymDS (bdf077b897b5f9f929b6bf0cfd436962) C:\WINDOWS\system32\drivers\NIS\1205000.07D\SYMDS.SYS

2011/02/05 14:55:35.0529 4380 SymEFA (7732298ad2eddd364c1d4f439d99ae7c) C:\WINDOWS\system32\drivers\NIS\1205000.07D\SYMEFA.SYS

2011/02/05 14:55:35.0560 4380 SymEvent (5c76a63fac8a5580c5a1c4a4ed827782) C:\WINDOWS\system32\Drivers\SYMEVENT.SYS

2011/02/05 14:55:35.0575 4380 SymIRON (a73399804d5d4a8b20ba60fcf70c9f1f) C:\WINDOWS\system32\drivers\NIS\1205000.07D\Ironx86.SYS

2011/02/05 14:55:35.0607 4380 SYMTDI (8c07683bf02b63ad71bcb2cf28af2d06) C:\WINDOWS\System32\Drivers\NIS\1205000.07D\SYMTDI.SYS

2011/02/05 14:55:35.0669 4380 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys

2011/02/05 14:55:35.0716 4380 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys

2011/02/05 14:55:35.0747 4380 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys

2011/02/05 14:55:35.0779 4380 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys

2011/02/05 14:55:35.0794 4380 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys

2011/02/05 14:55:35.0872 4380 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys

2011/02/05 14:55:35.0935 4380 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys

2011/02/05 14:55:35.0982 4380 USBAAPL (5c2bdc152bbab34f36473deaf7713f22) C:\WINDOWS\system32\Drivers\usbaapl.sys

2011/02/05 14:55:36.0013 4380 usbaudio (e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys

2011/02/05 14:55:36.0029 4380 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys

2011/02/05 14:55:36.0044 4380 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys

2011/02/05 14:55:36.0075 4380 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys

2011/02/05 14:55:36.0091 4380 usbohci (0daecce65366ea32b162f85f07c6753b) C:\WINDOWS\system32\DRIVERS\usbohci.sys

2011/02/05 14:55:36.0122 4380 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys

2011/02/05 14:55:36.0169 4380 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys

2011/02/05 14:55:36.0185 4380 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

2011/02/05 14:55:36.0216 4380 usbvideo (63bbfca7f390f4c49ed4b96bfb1633e0) C:\WINDOWS\system32\Drivers\usbvideo.sys

2011/02/05 14:55:36.0247 4380 usb_rndisx (b6cc50279d6cd28e090a5d33244adc9a) C:\WINDOWS\system32\DRIVERS\usb8023x.sys

2011/02/05 14:55:36.0279 4380 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys

2011/02/05 14:55:36.0325 4380 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys

2011/02/05 14:55:36.0357 4380 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys

2011/02/05 14:55:36.0388 4380 Wdf01000 (fd47474bd21794508af449d9d91af6e6) C:\WINDOWS\system32\DRIVERS\Wdf01000.sys

2011/02/05 14:55:36.0435 4380 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys

2011/02/05 14:55:36.0513 4380 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys

2011/02/05 14:55:36.0544 4380 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS

2011/02/05 14:55:36.0700 4380 ================================================================================

2011/02/05 14:55:36.0700 4380 Scan finished

2011/02/05 14:55:36.0700 4380 ================================================================================

2011/02/05 14:58:28.0763 5964 Deinitialize success

Does this help?

MrCharlie · February 5, 2011

The logs are clean, have you looked through those links I gave you?

Can you check the task manager to see what if anything is using up resources (causing that warning)?

MrC

CompUser1-11 · February 6, 2011

The logs are clean, have you looked through those links I gave you?
Can you check the task manager to see what if anything is using up resources (causing that warning)?
MrC

The weird thing about it, is that when the thing hangs it dosn't show any running processes. Is there a program that will record the shut down process to let me know where it hangs? I am keeping my fingers crossed that the apps that you had me run got rid of what ever was causing the hang. I am pretty convinced that it is some type of malware. I will look into those other suggestions just in case that's not true. Thanks for your help.

MrCharlie · February 7, 2011

OK......

Please Uninstall ComboFix:

Go to start > run and copy and paste next command in the field:

ComboFix /uninstall

Make sure there's a space between Combofix and /

Then hit enter.

This will uninstall Combofix, delete its related folders and files, hide file extensions, hide the system/hidden files and clears System Restore cache and create new Restore point

---------------

Please download OTL from one of the links below:

http://oldtimer.geekstogo.com/OTL.exe

http://oldtimer.geekstogo.com/OTL.com

Save it to your desktop.

Run OTL and hit the CleanUp button.

---------------

After looking at those links.....

Another suggestion would to uninstall Ad-Aware and Spybot - Search & Destroy, see if that makes a difference.

Let me know, MrC

LDTate · February 11, 2011

Since this issue is resolved I will close the thread to prevent others from posting here. If you need assistance please start your own topic and someone will be happy to assist you.

XP SP3 Hang on shut Down

Recommended Posts

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Recently Browsing 0 members

Important Information