DownloaderMislead.app - help required

Grateful if you could take a look at my HJT logfile, I'm running Vista SP1. Thanks.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:53:31, on 17/06/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\rundll32.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\Macromed\Flash\FlashUtil9f.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Users\PJ\Downloads\HiJack.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_gb&c=91&bd=Presario&pf=cnnb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://news.bbc.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_gb&c=91&bd=Presario&pf=cnnb
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_gb&c=91&bd=Presario&pf=cnnb
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\16.5.0.135\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\16.5.0.135\IPSBHO.DLL
O2 - BHO: AOL Toolbar BHO - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\16.5.0.135\coIEPlg.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [UpdateLBPShortCut] "C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\LabelPrint" UpdateWithCreateOnce "Software\CyberLink\LabelPrint\2.5"
O4 - HKLM\..\Run: [UpdatePSTShortCut] "C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\DVD Suite" UpdateWithCreateOnce "Software\CyberLink\PowerStarter"
O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\2.0"
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [QlbCtrl.exe] C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [UpdateP2GoShortCut] "C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"
O4 - HKLM\..\Run: [UpdatePDIRShortCut] "C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\PowerDirector" UpdateWithCreateOnce "SOFTWARE\CyberLink\PowerDirector\7.0"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O8 - Extra context menu item: &AOL Toolbar Search - C:\ProgramData\AOL\ieToolbar\resources\en-GB\local\search.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O17 - HKLM\System\CCS\Services\Tcpip\..\{ADD6E197-4EB8-4342-AE1B-6AFA2DCB7161}: NameServer = 85.255.112.205,85.255.112.202
O17 - HKLM\System\CCS\Services\Tcpip\..\{D1C1D536-F2AD-4D70-B6A8-E285E5B6A06F}: NameServer = 85.255.112.205,85.255.112.202
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.205,85.255.112.202
O17 - HKLM\System\CS6\Services\Tcpip\Parameters: NameServer = 85.255.112.205,85.255.112.202
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.205,85.255.112.202
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton Internet Security\Engine\16.5.0.135\coIEPlg.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Com4QLBEx - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
O23 - Service: Symantec Eraser Service (EraserSvc10910) - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\16.5.0.135\ccSvcHst.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Norton Internet Security - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\16.5.0.135\ccSvcHst.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Recovery Service for Windows - Unknown owner - C:\Program Files\SMINST\BLService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 9845 bytes

• Download combofix from here
  Link 1
  Link 2
  

1. If you are using Firefox, make sure that your download settings are as follows:

* Tools->Options->Main tab
* Set to "Always ask me where to Save the files".

2. During the download, rename Combofix to Combo-Fix as follows:





3. It is important you rename Combofix during the download, but not after.
4. Please do not rename Combofix to other names, but only to the one indicated.
5. Close any open browsers.
6. We need to disable your local AV (Anti-virus) before running Combofix.

• See HERE for how to disable your AV. (Norton/Ad-Watch)
  
• Double click on ComboFix.exe.
  
• Follow the prompts. NOTE:
  
• Allow combofix to run
  
• Post C:\combofix.txt back here.
  
  Note:
  Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
  

Combofix logfile follows. When Combofix rebooted the PC, Norton finally claimed to have dealt with the malware.

ComboFix 09-06-16.05 - PJ 17/06/2009 18:44.1 - NTFSx86
Microsoft Windows Vista Home Premium 6.0.6001.1.1252.44.1033.18.2814.1814 [GMT 1:00]
Running from: c:\users\PJ\Downloads\Combo-Fix.exe
SP: Lavasoft Ad-Watch Live! *disabled* (Updated) {67844DAE-4F77-4D69-9457-98E8CFFDAA22}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\drivers\MSIVXopshfcgvxuibbwixdvfjkhejgbwkurou.sys
c:\windows\system32\MSIVXcount
c:\windows\system32\MSIVXensavdjicpffonmirbkxljsclqusicnc.dll
c:\windows\system32\MSIVXnvxcrxfypemsnrpmtilbigshckslnhha.dll
D:\Desktop.ini

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_MSIVXserv.sys


((((((((((((((((((((((((( Files Created from 2009-05-17 to 2009-06-17 )))))))))))))))))))))))))))))))
.

2009-06-17 18:05 . 2009-06-17 18:06 -------- d-----w- c:\users\PJ\AppData\Local\temp
2009-06-17 17:11 . 2009-05-24 08:00 89104 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090617.003\NAVENG.SYS
2009-06-17 17:11 . 2009-05-24 08:00 876144 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090617.003\NAVEX15.SYS
2009-06-17 17:11 . 2009-05-24 08:00 177520 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090617.003\NAVENG32.DLL
2009-06-17 17:11 . 2009-05-24 08:00 1181040 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090617.003\NAVEX32A.DLL
2009-06-17 17:11 . 2009-05-24 08:00 371248 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090617.003\EECTRL.SYS
2009-06-17 17:11 . 2009-05-24 08:00 259368 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090617.003\ECMSVR32.DLL
2009-06-17 17:11 . 2009-05-24 08:00 2414128 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090617.003\CCERASER.DLL
2009-06-17 17:11 . 2009-05-24 08:00 101936 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090617.003\ERASER.SYS
2009-06-17 14:56 . 2009-03-16 20:03 533880 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090610.006\Scxpx86.dll
2009-06-17 14:56 . 2009-01-29 21:50 276344 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090610.006\IDSXpx86.sys
2009-06-17 14:56 . 2009-01-29 21:50 292912 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090610.006\IDSvix86.sys
2009-06-17 14:56 . 2009-01-29 21:50 447864 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090610.006\IDSxpx86.dll
2009-06-17 14:56 . 2009-01-29 21:50 396848 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090610.006\IDSviA64.sys
2009-06-14 20:06 . 2009-05-09 05:34 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-06-14 20:06 . 2009-05-09 05:50 915456 ----a-w- c:\windows\system32\wininet.dll
2009-06-14 20:03 . 2009-04-30 12:37 428544 ----a-w- c:\windows\system32\EncDec.dll
2009-06-14 20:03 . 2009-04-30 12:37 293376 ----a-w- c:\windows\system32\psisdecd.dll
2009-06-13 22:30 . 2009-04-21 11:55 2033152 ----a-w- c:\windows\system32\win32k.sys
2009-06-13 22:30 . 2009-04-23 12:42 636928 ----a-w- c:\windows\system32\localspl.dll
2009-06-13 22:30 . 2009-04-23 12:43 784896 ----a-w- c:\windows\system32\rpcrt4.dll
2009-06-11 21:26 . 2009-03-09 19:06 15688 ----a-w- c:\windows\system32\lsdelete.exe
2009-06-11 21:11 . 2009-03-09 19:06 64160 ----a-w- c:\windows\system32\drivers\Lbd.sys
2009-06-11 21:11 . 2009-06-11 21:11 -------- dc-h--w- c:\programdata\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2009-06-11 21:11 . 2009-03-12 08:17 2902048 -c--a-w- c:\programdata\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}\Ad-AwareAE.exe
2009-06-11 21:10 . 2009-06-11 21:11 -------- d-----w- c:\programdata\Lavasoft
2009-06-11 21:10 . 2009-06-11 21:10 -------- d-----w- c:\program files\Lavasoft
2009-06-09 02:24 . 2009-03-16 20:03 533880 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090604.001\Scxpx86.dll
2009-06-09 02:24 . 2009-01-29 21:50 276344 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090604.001\IDSXpx86.sys
2009-06-09 02:24 . 2009-01-29 21:50 292912 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090604.001\IDSvix86.sys
2009-06-09 02:24 . 2009-01-29 21:50 447864 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090604.001\IDSxpx86.dll
2009-06-09 02:24 . 2009-01-29 21:50 396848 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090604.001\IDSviA64.sys
2009-06-08 17:37 . 2009-06-08 17:37 -------- d-----w- c:\programdata\Media Center Programs
2009-06-08 17:35 . 2005-05-26 14:34 2297552 ----a-w- c:\windows\system32\d3dx9_26.dll
2009-06-08 17:16 . 2009-06-08 17:16 -------- d-----w- c:\program files\Ubisoft
2009-06-08 02:46 . 2009-06-08 02:46 -------- d-----w- c:\programdata\LightScribe
2009-06-08 02:39 . 2009-06-08 02:39 -------- d-----w- c:\program files\CCleaner
2009-06-04 20:10 . 2009-06-04 20:11 -------- d-----w- c:\program files\Microsoft IntelliPoint
2009-06-02 04:29 . 2009-06-08 02:42 -------- d-----w- c:\users\PJ\AppData\Roaming\Skype
2009-05-31 23:36 . 2009-05-31 23:36 -------- d-----w- c:\program files\Skype
2009-05-31 23:36 . 2009-05-31 23:36 -------- d-----w- c:\program files\Common Files\Skype
2009-05-31 23:35 . 2009-05-31 23:36 -------- d-----w- c:\programdata\Skype
2009-05-31 16:53 . 2009-06-09 22:52 -------- d-----w- c:\users\PJ\AppData\Local\Adobe
2009-05-25 20:23 . 2009-05-25 20:23 -------- d-----w- c:\users\PJ\AppData\Roaming\CyberLink
2009-05-25 20:23 . 2009-05-25 20:23 -------- d-----w- c:\users\Public\CyberLink
2009-05-25 16:07 . 2009-05-25 20:25 -------- d-----w- c:\users\PJ\AppData\Local\Apple Computer
2009-05-25 16:07 . 2009-05-25 16:07 -------- d-----w- c:\users\PJ\AppData\Roaming\Apple Computer
2009-05-25 16:06 . 2009-06-11 21:11 -------- dc----w- c:\windows\system32\DRVSTORE
2009-05-25 16:06 . 2009-03-19 15:32 23400 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2009-05-25 16:06 . 2008-04-17 11:12 107368 ----a-w- c:\windows\system32\GEARAspi.dll
2009-05-25 16:06 . 2009-05-25 16:06 -------- d-----w- c:\program files\iPod
2009-05-25 16:06 . 2009-05-25 16:06 -------- d-----w- c:\programdata\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-05-25 16:06 . 2009-05-25 16:06 -------- d-----w- c:\program files\iTunes
2009-05-25 16:06 . 2009-05-25 16:06 -------- d-----w- c:\program files\Bonjour
2009-05-25 16:05 . 2009-05-25 16:05 -------- d-----w- c:\program files\QuickTime
2009-05-25 16:05 . 2009-05-25 16:06 -------- d-----w- c:\programdata\Apple Computer
2009-05-25 16:05 . 2009-05-25 16:05 -------- d-----w- c:\users\PJ\AppData\Local\Apple
2009-05-25 16:05 . 2009-05-25 16:05 -------- d-----w- c:\program files\Apple Software Update
2009-05-25 16:04 . 2009-05-25 16:06 -------- d-----w- c:\program files\Common Files\Apple
2009-05-25 16:04 . 2009-05-25 16:04 -------- d-----w- c:\programdata\Apple
2009-05-25 15:05 . 2009-05-25 15:05 782664 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2009-05-25 14:58 . 2009-05-25 14:58 -------- d-----w- c:\users\PJ\AppData\Roaming\WildTangent
2009-05-25 14:34 . 2008-10-22 01:22 2048 ----a-w- c:\windows\system32\tzres.dll
2009-05-25 14:17 . 2008-06-20 01:14 97800 ----a-w- c:\windows\system32\infocardapi.dll
2009-05-25 14:17 . 2008-06-20 01:14 105016 ----a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2009-05-25 14:17 . 2008-06-20 01:14 43544 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2009-05-25 14:17 . 2008-06-20 01:14 11264 ----a-w- c:\windows\system32\icardres.dll
2009-05-25 14:17 . 2008-06-20 01:14 622080 ----a-w- c:\windows\system32\icardagt.exe
2009-05-25 14:17 . 2008-06-20 01:14 781344 ----a-w- c:\windows\system32\PresentationNative_v0300.dll
2009-05-25 14:17 . 2008-06-20 01:14 326160 ----a-w- c:\windows\system32\PresentationHost.exe
2009-05-25 14:09 . 2008-07-27 18:03 96760 ----a-w- c:\windows\system32\dfshim.dll
2009-05-25 14:09 . 2008-07-27 18:03 282112 ----a-w- c:\windows\system32\mscoree.dll
2009-05-25 14:09 . 2008-07-27 18:03 41984 ----a-w- c:\windows\system32\netfxperf.dll
2009-05-25 14:09 . 2008-07-27 18:03 158720 ----a-w- c:\windows\system32\mscorier.dll
2009-05-25 14:09 . 2008-07-27 18:03 83968 ----a-w- c:\windows\system32\mscories.dll
2009-05-25 14:07 . 2009-05-25 14:07 -------- d-----w- c:\program files\MSXML 4.0
2009-05-25 14:07 . 2009-05-25 14:06 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-05-25 12:58 . 2008-09-10 03:40 1334272 ----a-w- c:\windows\system32\msxml6.dll
2009-05-25 12:52 . 2008-10-16 21:09 51224 ----a-w- c:\windows\system32\wuauclt.exe
2009-05-25 12:52 . 2008-10-16 21:09 43544 ----a-w- c:\windows\system32\wups2.dll
2009-05-25 12:52 . 2008-10-16 20:56 1524736 ----a-w- c:\windows\system32\wucltux.dll
2009-05-25 12:52 . 2008-10-16 21:13 1809944 ----a-w- c:\windows\system32\wuaueng.dll
2009-05-25 12:52 . 2009-05-25 12:52 -------- d-----w- c:\users\PJ\AppData\Local\AOL
2009-05-25 12:51 . 2008-10-16 21:12 561688 ----a-w- c:\windows\system32\wuapi.dll
2009-05-25 12:51 . 2008-10-16 21:08 34328 ----a-w- c:\windows\system32\wups.dll
2009-05-25 12:51 . 2008-10-16 20:55 83456 ----a-w- c:\windows\system32\wudriver.dll
2009-05-25 12:51 . 2008-10-16 13:08 162064 ----a-w- c:\windows\system32\wuwebv.dll
2009-05-25 12:51 . 2008-10-16 12:56 31232 ----a-w- c:\windows\system32\wuapp.exe
2009-05-25 12:48 . 2009-03-12 08:42 25136 ----a-r- c:\windows\system32\drivers\SymIMV.sys
2009-05-25 12:48 . 2009-05-25 18:05 124464 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2009-05-25 12:48 . 2009-05-25 18:05 -------- d-----w- c:\program files\Symantec
2009-05-25 12:48 . 2009-05-25 14:49 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-05-25 12:47 . 2009-05-25 12:47 -------- d-----w- c:\users\PJ\AppData\Local\Hewlett-Packard
2009-05-25 12:47 . 2009-05-25 12:47 -------- d-----w- c:\users\PJ\AppData\Roaming\Hewlett-Packard
2009-05-25 12:44 . 2009-06-14 20:31 75656 ----a-w- c:\users\PJ\AppData\Local\GDIPFONTCACHEV1.DAT
2009-05-25 12:42 . 2009-05-25 12:42 -------- d-----w- c:\users\PJ\AppData\Roaming\HP TCS

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-14 20:04 . 2009-03-13 20:04 -------- d-----w- c:\programdata\NVIDIA
2009-06-09 23:56 . 2008-10-26 10:53 -------- d-----w- c:\program files\Common Files\Adobe
2009-06-08 19:13 . 2009-06-08 19:03 27554 ----a-w- c:\programdata\nvModes.dat
2009-06-08 17:16 . 2008-10-26 09:45 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-05-25 20:23 . 2008-10-26 10:54 -------- d-----w- c:\programdata\CyberLink
2009-05-25 18:05 . 2009-05-25 12:48 805 ----a-w- c:\windows\system32\drivers\SYMEVENT.INF
2009-05-25 18:05 . 2009-05-25 12:48 7386 ----a-w- c:\windows\system32\drivers\SYMEVENT.CAT
2009-05-25 15:18 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-05-25 14:58 . 2008-10-26 10:04 -------- d-----w- c:\programdata\WildTangent
2009-05-25 14:17 . 2008-10-26 09:48 -------- d-----w- c:\programdata\Symantec
2009-05-25 14:06 . 2008-10-26 11:06 -------- d-----w- c:\program files\Java
2009-05-25 12:48 . 2008-10-26 09:47 -------- d-----w- c:\programdata\Norton
2009-05-25 12:46 . 2008-10-26 11:10 -------- d-----w- c:\program files\SMINST
2009-05-25 12:42 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Sidebar
2009-05-25 12:40 . 2009-05-25 12:40 0 --sha-r- c:\windows\system32\drivers\103C_HP_cNB_Presario CQ60 Notebook PC_Y5335KV_0U_Q2CE910C860_E508165-031_4A_I303C_SWistron_V08.49_F.35_T090217_WV3-1_L409_M2814_J250_7AMD_8F31_92.10_#090313_N168C001C;10DE0760_(NR466EA#ABU)_XMOBILE_CN10_Z_2F.35.MRK
2009-04-02 15:29 . 2009-04-02 15:29 75048 ----a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 8.1.1.10\SetupAdmin.exe
2009-03-26 07:00 . 2009-03-26 07:00 64000 ----a-w- c:\windows\system32\drivers\RTSTOR.sys
2008-10-26 10:07 . 2008-10-26 09:53 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-07-11 13543968]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-07-11 92704]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-04-17 1049896]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2008-09-24 468264]
"UpdateLBPShortCut"="c:\program files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]
"UpdatePSTShortCut"="c:\program files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" [2008-10-07 210216]
"UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2007-12-24 222504]
"QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2008-08-01 202032]
"UpdateP2GoShortCut"="c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]
"UpdatePDIRShortCut"="c:\program files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-25 148888]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-10-09 75008]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2008-04-15 488752]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2007-08-31 1037736]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-03-09 515416]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]
@="FSFilter Activity Monitor"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{D662C038-41E9-431E-A45D-BA54FC4A8A84}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{9DCA3F9D-31B2-4A26-88AC-EA2B26F33A39}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{FC92EA0E-A43D-456F-974D-006C821AE3CF}"= c:\program files\CyberLink\PowerDirector\PDR.EXE:CyberLink PowerDirector
"{EF0AD0D2-BE70-44E9-9751-864A58EBF2BE}"= c:\program files\HP\QuickPlay\QP.exe:Quick Play
"{BA92CF10-E4E3-49FB-80EA-566F7F203432}"= c:\program files\HP\QuickPlay\QPService.exe:Quick Play Resident Program
"{B50A5C8B-6EE5-4119-95C1-A6385329D2EE}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{2A90F61D-4985-45D5-80F2-DC433DD2B553}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{1387DCF7-2A1F-4F6E-82DC-8C917859437C}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{7CDC83B4-34FD-4265-B070-AEE216BB5221}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"{7205C7E2-411E-4A99-B768-3AF3598027F8}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{68C0C2AE-6E65-4DF7-AFFE-C91EA7820F86}"= UDP:c:\program files\Ubisoft\Tom Clancy's H.A.W.X\HAWX.exe:Tom Clancy's H.A.W.X
"{3DCA15E1-294C-47D2-82D9-A3FE2126BB7B}"= TCP:c:\program files\Ubisoft\Tom Clancy's H.A.W.X\HAWX.exe:Tom Clancy's H.A.W.X
"{3D3186A4-F215-45D9-A345-1A5F5E9F2C28}"= UDP:c:\program files\Ubisoft\Tom Clancy's H.A.W.X\HAWX_dx10.exe:Tom Clancy's H.A.W.X
"{5E03BD38-B9DF-4415-8897-9E3D6078E99D}"= TCP:c:\program files\Ubisoft\Tom Clancy's H.A.W.X\HAWX_dx10.exe:Tom Clancy's H.A.W.X

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

R0 Lbd;Lbd;c:\windows\System32\drivers\Lbd.sys [11/06/2009 22:11 64160]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\System32\drivers\NIS\1005000.087\SymEFA.sys [25/05/2009 19:05 310320]
R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\System32\drivers\NIS\1005000.087\BHDrvx86.sys [25/05/2009 19:05 258608]
R1 ccHP;Symantec Hash Provider;c:\windows\System32\drivers\NIS\1005000.087\cchpx86.sys [25/05/2009 19:05 482352]
R1 IDSVix86;IDSVix86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090610.006\IDSvix86.sys [17/06/2009 15:56 292912]
R2 ezSharedSvc;Easybits Shared Services for Windows;c:\windows\system32\svchost.exe -k netsvcs [21/01/2008 03:23 21504]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [09/03/2009 20:06 951632]
R2 Norton Internet Security;Norton Internet Security;c:\program files\Norton Internet Security\Engine\16.5.0.135\ccSvcHst.exe [25/05/2009 19:05 115560]
R2 Recovery Service for Windows;Recovery Service for Windows;c:\program files\SMINST\BLService.exe [26/10/2008 12:10 365952]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [25/05/2009 15:51 101936]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\System32\drivers\nvhda32v.sys [09/05/2008 20:17 43040]
R3 SYMNDISV;Symantec Network Filter Driver;c:\windows\System32\drivers\NIS\1005000.087\symndisv.sys [25/05/2009 19:05 39984]
S3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [26/10/2008 11:01 193840]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
ezSharedSvc

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Common Files\LightScribe\LSRunOnce.exe"
.
Contents of the 'Scheduled Tasks' folder

2009-06-11 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 19:06]

2009-06-17 c:\windows\Tasks\User_Feed_Synchronization-{193FE727-244F-4728-8DBF-86BA89892B34}.job
- c:\windows\system32\msfeedssync.exe [2009-06-14 11:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://news.bbc.co.uk/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_gb&c=91&bd=Presario&pf=cnnb
uInternet Settings,ProxyOverride = *.local
IE: &AOL Toolbar Search - c:\programdata\AOL\ieToolbar\resources\en-GB\local\search.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-17 19:06
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Norton Internet Security]
"ImagePath"="\"c:\program files\Norton Internet Security\Engine\16.5.0.135\ccSvcHst.exe\" /s \"Norton Internet Security\" /m \"c:\program files\Norton Internet Security\Engine\16.5.0.135\diMaster.dll\" /prefetch:1"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2009-06-17 19:07
ComboFix-quarantined-files.txt 2009-06-17 18:07

Pre-Run: 160,953,937,920 bytes free
Post-Run: 161,011,793,920 bytes free

255 --- E O F --- 2009-06-14 20:07

Now open a new notepad file.
Input this into the notepad file:

KILLALL::

Driver::
ezSharedSvc

NetSvc::
ezSharedSvc

Save this as CFScript.txt, save it to your desktop also.
Then drag and drop CFScript.txt into combofix as seen below:


This will open combofix again, agree to it's terms and allow it to run.
It may want to reboot after it's done. (It will warn you if it wants to)
Post the resulting log back here.

logfile as discussed:

ComboFix 09-06-16.05 - PJ 17/06/2009 19:30.2 - NTFSx86
Microsoft Windows Vista Home Premium 6.0.6001.1.1252.44.1033.18.2814.1806 [GMT 1:00]
Running from: c:\users\PJ\Desktop\Combo-Fix.exe
Command switches used :: c:\users\PJ\Desktop\CFScript.txt
SP: Lavasoft Ad-Watch Live! *disabled* (Updated) {67844DAE-4F77-4D69-9457-98E8CFFDAA22}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_ezSharedSvc


((((((((((((((((((((((((( Files Created from 2009-05-17 to 2009-06-17 )))))))))))))))))))))))))))))))
.

2009-06-17 17:11 . 2009-05-24 08:00 89104 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090617.003\NAVENG.SYS
2009-06-17 17:11 . 2009-05-24 08:00 876144 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090617.003\NAVEX15.SYS
2009-06-17 17:11 . 2009-05-24 08:00 177520 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090617.003\NAVENG32.DLL
2009-06-17 17:11 . 2009-05-24 08:00 1181040 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090617.003\NAVEX32A.DLL
2009-06-17 17:11 . 2009-05-24 08:00 371248 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090617.003\EECTRL.SYS
2009-06-17 17:11 . 2009-05-24 08:00 259368 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090617.003\ECMSVR32.DLL
2009-06-17 17:11 . 2009-05-24 08:00 2414128 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090617.003\CCERASER.DLL
2009-06-17 17:11 . 2009-05-24 08:00 101936 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090617.003\ERASER.SYS
2009-06-17 14:56 . 2009-03-16 20:03 533880 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090610.006\Scxpx86.dll
2009-06-17 14:56 . 2009-01-29 21:50 276344 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090610.006\IDSXpx86.sys
2009-06-17 14:56 . 2009-01-29 21:50 292912 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090610.006\IDSvix86.sys
2009-06-17 14:56 . 2009-01-29 21:50 447864 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090610.006\IDSxpx86.dll
2009-06-17 14:56 . 2009-01-29 21:50 396848 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090610.006\IDSviA64.sys
2009-06-14 20:06 . 2009-05-09 05:34 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-06-14 20:06 . 2009-05-09 05:50 915456 ----a-w- c:\windows\system32\wininet.dll
2009-06-14 20:03 . 2009-04-30 12:37 428544 ----a-w- c:\windows\system32\EncDec.dll
2009-06-14 20:03 . 2009-04-30 12:37 293376 ----a-w- c:\windows\system32\psisdecd.dll
2009-06-13 22:30 . 2009-04-21 11:55 2033152 ----a-w- c:\windows\system32\win32k.sys
2009-06-13 22:30 . 2009-04-23 12:42 636928 ----a-w- c:\windows\system32\localspl.dll
2009-06-13 22:30 . 2009-04-23 12:43 784896 ----a-w- c:\windows\system32\rpcrt4.dll
2009-06-11 21:26 . 2009-03-09 19:06 15688 ----a-w- c:\windows\system32\lsdelete.exe
2009-06-11 21:11 . 2009-03-09 19:06 64160 ----a-w- c:\windows\system32\drivers\Lbd.sys
2009-06-11 21:11 . 2009-06-11 21:11 -------- dc-h--w- c:\programdata\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2009-06-11 21:11 . 2009-03-12 08:17 2902048 -c--a-w- c:\programdata\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}\Ad-AwareAE.exe
2009-06-11 21:10 . 2009-06-11 21:11 -------- d-----w- c:\programdata\Lavasoft
2009-06-11 21:10 . 2009-06-11 21:10 -------- d-----w- c:\program files\Lavasoft
2009-06-09 02:24 . 2009-03-16 20:03 533880 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090604.001\Scxpx86.dll
2009-06-09 02:24 . 2009-01-29 21:50 276344 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090604.001\IDSXpx86.sys
2009-06-09 02:24 . 2009-01-29 21:50 292912 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090604.001\IDSvix86.sys
2009-06-09 02:24 . 2009-01-29 21:50 447864 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090604.001\IDSxpx86.dll
2009-06-09 02:24 . 2009-01-29 21:50 396848 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090604.001\IDSviA64.sys
2009-06-08 17:37 . 2009-06-08 17:37 -------- d-----w- c:\programdata\Media Center Programs
2009-06-08 17:35 . 2005-05-26 14:34 2297552 ----a-w- c:\windows\system32\d3dx9_26.dll
2009-06-08 17:16 . 2009-06-08 17:16 -------- d-----w- c:\program files\Ubisoft
2009-06-08 02:46 . 2009-06-08 02:46 -------- d-----w- c:\programdata\LightScribe
2009-06-08 02:39 . 2009-06-08 02:39 -------- d-----w- c:\program files\CCleaner
2009-06-04 20:10 . 2009-06-04 20:11 -------- d-----w- c:\program files\Microsoft IntelliPoint
2009-06-02 04:29 . 2009-06-08 02:42 -------- d-----w- c:\users\PJ\AppData\Roaming\Skype
2009-05-31 23:36 . 2009-05-31 23:36 -------- d-----w- c:\program files\Skype
2009-05-31 23:36 . 2009-05-31 23:36 -------- d-----w- c:\program files\Common Files\Skype
2009-05-31 23:35 . 2009-05-31 23:36 -------- d-----w- c:\programdata\Skype
2009-05-31 16:53 . 2009-06-09 22:52 -------- d-----w- c:\users\PJ\AppData\Local\Adobe
2009-05-25 20:23 . 2009-05-25 20:23 -------- d-----w- c:\users\PJ\AppData\Roaming\CyberLink
2009-05-25 20:23 . 2009-05-25 20:23 -------- d-----w- c:\users\Public\CyberLink
2009-05-25 16:07 . 2009-05-25 20:25 -------- d-----w- c:\users\PJ\AppData\Local\Apple Computer
2009-05-25 16:07 . 2009-05-25 16:07 -------- d-----w- c:\users\PJ\AppData\Roaming\Apple Computer
2009-05-25 16:06 . 2009-06-11 21:11 -------- dc----w- c:\windows\system32\DRVSTORE
2009-05-25 16:06 . 2009-03-19 15:32 23400 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2009-05-25 16:06 . 2008-04-17 11:12 107368 ----a-w- c:\windows\system32\GEARAspi.dll
2009-05-25 16:06 . 2009-05-25 16:06 -------- d-----w- c:\program files\iPod
2009-05-25 16:06 . 2009-05-25 16:06 -------- d-----w- c:\programdata\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-05-25 16:06 . 2009-05-25 16:06 -------- d-----w- c:\program files\iTunes
2009-05-25 16:06 . 2009-05-25 16:06 -------- d-----w- c:\program files\Bonjour
2009-05-25 16:05 . 2009-05-25 16:05 -------- d-----w- c:\program files\QuickTime
2009-05-25 16:05 . 2009-05-25 16:06 -------- d-----w- c:\programdata\Apple Computer
2009-05-25 16:05 . 2009-05-25 16:05 -------- d-----w- c:\users\PJ\AppData\Local\Apple
2009-05-25 16:05 . 2009-05-25 16:05 -------- d-----w- c:\program files\Apple Software Update
2009-05-25 16:04 . 2009-05-25 16:06 -------- d-----w- c:\program files\Common Files\Apple
2009-05-25 16:04 . 2009-05-25 16:04 -------- d-----w- c:\programdata\Apple
2009-05-25 15:05 . 2009-05-25 15:05 782664 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2009-05-25 14:58 . 2009-05-25 14:58 -------- d-----w- c:\users\PJ\AppData\Roaming\WildTangent
2009-05-25 14:34 . 2008-10-22 01:22 2048 ----a-w- c:\windows\system32\tzres.dll
2009-05-25 14:17 . 2008-06-20 01:14 97800 ----a-w- c:\windows\system32\infocardapi.dll
2009-05-25 14:17 . 2008-06-20 01:14 105016 ----a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2009-05-25 14:17 . 2008-06-20 01:14 43544 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2009-05-25 14:17 . 2008-06-20 01:14 11264 ----a-w- c:\windows\system32\icardres.dll
2009-05-25 14:17 . 2008-06-20 01:14 622080 ----a-w- c:\windows\system32\icardagt.exe
2009-05-25 14:17 . 2008-06-20 01:14 781344 ----a-w- c:\windows\system32\PresentationNative_v0300.dll
2009-05-25 14:17 . 2008-06-20 01:14 326160 ----a-w- c:\windows\system32\PresentationHost.exe
2009-05-25 14:09 . 2008-07-27 18:03 96760 ----a-w- c:\windows\system32\dfshim.dll
2009-05-25 14:09 . 2008-07-27 18:03 282112 ----a-w- c:\windows\system32\mscoree.dll
2009-05-25 14:09 . 2008-07-27 18:03 41984 ----a-w- c:\windows\system32\netfxperf.dll
2009-05-25 14:09 . 2008-07-27 18:03 158720 ----a-w- c:\windows\system32\mscorier.dll
2009-05-25 14:09 . 2008-07-27 18:03 83968 ----a-w- c:\windows\system32\mscories.dll
2009-05-25 14:07 . 2009-05-25 14:07 -------- d-----w- c:\program files\MSXML 4.0
2009-05-25 14:07 . 2009-05-25 14:06 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-05-25 12:58 . 2008-09-10 03:40 1334272 ----a-w- c:\windows\system32\msxml6.dll
2009-05-25 12:52 . 2008-10-16 21:09 51224 ----a-w- c:\windows\system32\wuauclt.exe
2009-05-25 12:52 . 2008-10-16 21:09 43544 ----a-w- c:\windows\system32\wups2.dll
2009-05-25 12:52 . 2008-10-16 20:56 1524736 ----a-w- c:\windows\system32\wucltux.dll
2009-05-25 12:52 . 2008-10-16 21:13 1809944 ----a-w- c:\windows\system32\wuaueng.dll
2009-05-25 12:52 . 2009-05-25 12:52 -------- d-----w- c:\users\PJ\AppData\Local\AOL
2009-05-25 12:51 . 2008-10-16 21:12 561688 ----a-w- c:\windows\system32\wuapi.dll
2009-05-25 12:51 . 2008-10-16 21:08 34328 ----a-w- c:\windows\system32\wups.dll
2009-05-25 12:51 . 2008-10-16 20:55 83456 ----a-w- c:\windows\system32\wudriver.dll
2009-05-25 12:51 . 2008-10-16 13:08 162064 ----a-w- c:\windows\system32\wuwebv.dll
2009-05-25 12:51 . 2008-10-16 12:56 31232 ----a-w- c:\windows\system32\wuapp.exe
2009-05-25 12:48 . 2009-03-12 08:42 25136 ----a-r- c:\windows\system32\drivers\SymIMV.sys
2009-05-25 12:48 . 2009-05-25 18:05 124464 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2009-05-25 12:48 . 2009-05-25 18:05 -------- d-----w- c:\program files\Symantec
2009-05-25 12:48 . 2009-05-25 14:49 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-05-25 12:47 . 2009-05-25 12:47 -------- d-----w- c:\users\PJ\AppData\Local\Hewlett-Packard
2009-05-25 12:47 . 2009-05-25 12:47 -------- d-----w- c:\users\PJ\AppData\Roaming\Hewlett-Packard
2009-05-25 12:44 . 2009-06-14 20:31 75656 ----a-w- c:\users\PJ\AppData\Local\GDIPFONTCACHEV1.DAT
2009-05-25 12:42 . 2009-05-25 12:42 -------- d-----w- c:\users\PJ\AppData\Roaming\HP TCS

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-14 20:04 . 2009-03-13 20:04 -------- d-----w- c:\programdata\NVIDIA
2009-06-09 23:56 . 2008-10-26 10:53 -------- d-----w- c:\program files\Common Files\Adobe
2009-06-08 19:13 . 2009-06-08 19:03 27554 ----a-w- c:\programdata\nvModes.dat
2009-06-08 17:16 . 2008-10-26 09:45 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-05-25 20:23 . 2008-10-26 10:54 -------- d-----w- c:\programdata\CyberLink
2009-05-25 18:05 . 2009-05-25 12:48 805 ----a-w- c:\windows\system32\drivers\SYMEVENT.INF
2009-05-25 18:05 . 2009-05-25 12:48 7386 ----a-w- c:\windows\system32\drivers\SYMEVENT.CAT
2009-05-25 15:18 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-05-25 14:58 . 2008-10-26 10:04 -------- d-----w- c:\programdata\WildTangent
2009-05-25 14:17 . 2008-10-26 09:48 -------- d-----w- c:\programdata\Symantec
2009-05-25 14:06 . 2008-10-26 11:06 -------- d-----w- c:\program files\Java
2009-05-25 12:48 . 2008-10-26 09:47 -------- d-----w- c:\programdata\Norton
2009-05-25 12:46 . 2008-10-26 11:10 -------- d-----w- c:\program files\SMINST
2009-05-25 12:42 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Sidebar
2009-05-25 12:40 . 2009-05-25 12:40 0 --sha-r- c:\windows\system32\drivers\103C_HP_cNB_Presario CQ60 Notebook PC_Y5335KV_0U_Q2CE910C860_E508165-031_4A_I303C_SWistron_V08.49_F.35_T090217_WV3-1_L409_M2814_J250_7AMD_8F31_92.10_#090313_N168C001C;10DE0760_(NR466EA#ABU)_XMOBILE_CN10_Z_2F.35.MRK
2009-04-02 15:29 . 2009-04-02 15:29 75048 ----a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 8.1.1.10\SetupAdmin.exe
2009-03-26 07:00 . 2009-03-26 07:00 64000 ----a-w- c:\windows\system32\drivers\RTSTOR.sys
2008-10-26 10:07 . 2008-10-26 09:53 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT
.

((((((((((((((((((((((((((((( SnapShot@2009-06-17_18.06.17 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-06-17 17:43 . 2009-06-17 17:43 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2009-06-17 18:35 . 2009-06-17 18:35 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2009-06-17 18:35 . 2009-06-17 18:35 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2009-06-17 17:43 . 2009-06-17 17:43 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2006-11-02 10:22 . 2009-06-17 18:33 6365184 c:\windows\System32\SMI\Store\Machine\SCHEMA.DAT
+ 2009-06-17 18:33 . 2009-06-17 18:33 6365184 c:\windows\ERDNT\subs\SCHEMA.DAT
+ 2009-06-17 18:29 . 2009-06-17 18:29 6365184 c:\windows\ERDNT\Hiv-backup\SCHEMA.DAT
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-07-11 13543968]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-07-11 92704]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-04-17 1049896]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2008-09-24 468264]
"UpdateLBPShortCut"="c:\program files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]
"UpdatePSTShortCut"="c:\program files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" [2008-10-07 210216]
"UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2007-12-24 222504]
"QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2008-08-01 202032]
"UpdateP2GoShortCut"="c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]
"UpdatePDIRShortCut"="c:\program files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-25 148888]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-10-09 75008]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2008-04-15 488752]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2007-08-31 1037736]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-03-09 515416]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]
@="FSFilter Activity Monitor"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{D662C038-41E9-431E-A45D-BA54FC4A8A84}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{9DCA3F9D-31B2-4A26-88AC-EA2B26F33A39}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{FC92EA0E-A43D-456F-974D-006C821AE3CF}"= c:\program files\CyberLink\PowerDirector\PDR.EXE:CyberLink PowerDirector
"{EF0AD0D2-BE70-44E9-9751-864A58EBF2BE}"= c:\program files\HP\QuickPlay\QP.exe:Quick Play
"{BA92CF10-E4E3-49FB-80EA-566F7F203432}"= c:\program files\HP\QuickPlay\QPService.exe:Quick Play Resident Program
"{B50A5C8B-6EE5-4119-95C1-A6385329D2EE}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{2A90F61D-4985-45D5-80F2-DC433DD2B553}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{1387DCF7-2A1F-4F6E-82DC-8C917859437C}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{7CDC83B4-34FD-4265-B070-AEE216BB5221}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"{7205C7E2-411E-4A99-B768-3AF3598027F8}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{68C0C2AE-6E65-4DF7-AFFE-C91EA7820F86}"= UDP:c:\program files\Ubisoft\Tom Clancy's H.A.W.X\HAWX.exe:Tom Clancy's H.A.W.X
"{3DCA15E1-294C-47D2-82D9-A3FE2126BB7B}"= TCP:c:\program files\Ubisoft\Tom Clancy's H.A.W.X\HAWX.exe:Tom Clancy's H.A.W.X
"{3D3186A4-F215-45D9-A345-1A5F5E9F2C28}"= UDP:c:\program files\Ubisoft\Tom Clancy's H.A.W.X\HAWX_dx10.exe:Tom Clancy's H.A.W.X
"{5E03BD38-B9DF-4415-8897-9E3D6078E99D}"= TCP:c:\program files\Ubisoft\Tom Clancy's H.A.W.X\HAWX_dx10.exe:Tom Clancy's H.A.W.X

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

R0 Lbd;Lbd;c:\windows\System32\drivers\Lbd.sys [11/06/2009 22:11 64160]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\System32\drivers\NIS\1005000.087\SymEFA.sys [25/05/2009 19:05 310320]
R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\System32\drivers\NIS\1005000.087\BHDrvx86.sys [25/05/2009 19:05 258608]
R1 ccHP;Symantec Hash Provider;c:\windows\System32\drivers\NIS\1005000.087\cchpx86.sys [25/05/2009 19:05 482352]
R1 IDSVix86;IDSVix86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090610.006\IDSvix86.sys [17/06/2009 15:56 292912]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [09/03/2009 20:06 951632]
R2 Norton Internet Security;Norton Internet Security;c:\program files\Norton Internet Security\Engine\16.5.0.135\ccSvcHst.exe [25/05/2009 19:05 115560]
R2 Recovery Service for Windows;Recovery Service for Windows;c:\program files\SMINST\BLService.exe [26/10/2008 12:10 365952]
R3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [26/10/2008 11:01 193840]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [25/05/2009 15:51 101936]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\System32\drivers\nvhda32v.sys [09/05/2008 20:17 43040]
R3 SYMNDISV;Symantec Network Filter Driver;c:\windows\System32\drivers\NIS\1005000.087\symndisv.sys [25/05/2009 19:05 39984]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Common Files\LightScribe\LSRunOnce.exe"
.
Contents of the 'Scheduled Tasks' folder

2009-06-11 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 19:06]

2009-06-17 c:\windows\Tasks\User_Feed_Synchronization-{193FE727-244F-4728-8DBF-86BA89892B34}.job
- c:\windows\system32\msfeedssync.exe [2009-06-14 11:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://news.bbc.co.uk/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_gb&c=91&bd=Presario&pf=cnnb
uInternet Settings,ProxyOverride = *.local
IE: &AOL Toolbar Search - c:\programdata\AOL\ieToolbar\resources\en-GB\local\search.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-17 19:35
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Norton Internet Security]
"ImagePath"="\"c:\program files\Norton Internet Security\Engine\16.5.0.135\ccSvcHst.exe\" /s \"Norton Internet Security\" /m \"c:\program files\Norton Internet Security\Engine\16.5.0.135\diMaster.dll\" /prefetch:1"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
------------------------ Other Running Processes ------------------------
.
c:\windows\System32\nvvsvc.exe
c:\windows\System32\audiodg.exe
c:\windows\System32\rundll32.exe
c:\windows\System32\wlanext.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\CyberLink\Shared files\RichVideo.exe
c:\windows\System32\drivers\XAudio.exe
c:\windows\System32\wbem\unsecapp.exe
c:\windows\System32\rundll32.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\windows\ehome\ehmsas.exe
c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
c:\windows\System32\wbem\unsecapp.exe
c:\program files\Hewlett-Packard\Shared\HpqToaster.exe
c:\program files\Microsoft IntelliPoint\dpupdchk.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Synaptics\SynTP\SynTPHelper.exe
c:\program files\Hewlett-Packard\HP Health Check\HPHC_Service.exe
.
**************************************************************************
.
Completion time: 2009-06-17 19:39 - machine was rebooted
ComboFix-quarantined-files.txt 2009-06-17 18:39
ComboFix2.txt 2009-06-17 18:07

Pre-Run: 161,021,747,200 bytes free
Post-Run: 160,834,576,384 bytes free

283 --- E O F --- 2009-06-14 20:07

Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

ComboFix /u



This will also reset your restore points.

How is the machine running now?

Yes, all running well now - the browser hijack has stopped. Do you think combofix has been successful?

Thanks for your swift help!

Yep.
You had a new variant of a TDSS family rootkit, that was the main problem.

Copy that! thanks again.