ComboFix 09-09-25.01 - Robert Hornshaw 26/09/2009 8:33.1.4 - NTFSx86
Microsoft
Windows Vista
Home Premium 6.0.6002.2.1252.44.1033.18.3292.2139 [GMT 1:00]
Running from: c:\users\Robert Hornshaw\Downloads\combo-fix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\$recycle.bin\S-1-5-21-2587230002-3812537154-1661091937-500
c:\$recycle.bin\S-1-5-21-2773397201-2855733099-4214572315-500
c:\program files\FunWebProducts
c:\program files\MyWebSearch
c:\program files\MyWebSearch\bar\1.bin\F3BKGERR.JPG
c:\program files\MyWebSearch\bar\1.bin\F3CJpeg.dll
c:\program files\MyWebSearch\bar\1.bin\F3DTactl.dll
c:\program files\MyWebSearch\bar\1.bin\F3HISTSW.DLL
c:\program files\MyWebSearch\bar\1.bin\F3HKSTUB.DLL
c:\program files\MyWebSearch\bar\1.bin\F3HTmlmu.dll
c:\program files\MyWebSearch\bar\1.bin\F3HTtpct.dll
c:\program files\MyWebSearch\bar\1.bin\F3POPSWT.DLL
c:\program files\MyWebSearch\bar\1.bin\F3PSSAVR.SCR
c:\program files\MyWebSearch\bar\1.bin\F3REGHK.DLL
c:\program files\MyWebSearch\bar\1.bin\F3REPROX.DLL
c:\program files\MyWebSearch\bar\1.bin\F3RESTUB.DLL
c:\program files\MyWebSearch\bar\1.bin\F3SCHMON.EXE
c:\program files\MyWebSearch\bar\1.bin\F3SCrctr.dll
c:\program files\MyWebSearch\bar\1.bin\F3SPACER.WMV
c:\program files\MyWebSearch\bar\1.bin\F3WALLPP.DAT
c:\program files\MyWebSearch\bar\1.bin\F3WPHOOK.DLL
c:\program files\MyWebSearch\bar\1.bin\FWPBUDDY.PNG
c:\program files\MyWebSearch\bar\1.bin\M3FFXTBR.JAR
c:\program files\MyWebSearch\bar\1.bin\M3FFXTBR.MANIFEST
c:\program files\MyWebSearch\bar\1.bin\M3HIGHIN.EXE
c:\program files\MyWebSearch\bar\1.bin\M3HTml.dll
c:\program files\MyWebSearch\bar\1.bin\M3IDLE.DLL
c:\program files\MyWebSearch\bar\1.bin\M3IMPIPE.EXE
c:\program files\MyWebSearch\bar\1.bin\M3MEDINT.EXE
c:\program files\MyWebSearch\bar\1.bin\M3MSG.DLL
c:\program files\MyWebSearch\bar\1.bin\M3NTSTBR.JAR
c:\program files\MyWebSearch\bar\1.bin\M3NTSTBR.MANIFEST
c:\program files\MyWebSearch\bar\1.bin\M3OUtlcn.dll
c:\program files\MyWebSearch\bar\1.bin\M3PLUGIN.DLL
c:\program files\MyWebSearch\bar\1.bin\M3SKIN.DLL
c:\program files\MyWebSearch\bar\1.bin\M3SKPLAY.EXE
c:\program files\MyWebSearch\bar\1.bin\M3SLSRCH.EXE
c:\program files\MyWebSearch\bar\1.bin\M3SRCHMN.EXE
c:\program files\MyWebSearch\bar\1.bin\MWSBAR.DLL
c:\program files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
c:\program files\MyWebSearch\bar\1.bin\MWSOEPLG.DLL
c:\program files\MyWebSearch\bar\1.bin\MWSOESTB.DLL
c:\program files\MyWebSearch\bar\1.bin\MWSSrcas.dll
c:\program files\MyWebSearch\bar\1.bin\MWSSVC.EXE
c:\program files\MyWebSearch\bar\1.bin\NPMYWEBS.DLL
c:\program files\MyWebSearch\bar\Avatar\COMMON.F3S
c:\program files\MyWebSearch\bar\Game\CHECKERS.F3S
c:\program files\MyWebSearch\bar\Game\CHESS.F3S
c:\program files\MyWebSearch\bar\Game\REVERSI.F3S
c:\program files\MyWebSearch\bar\icons\CM.ICO
c:\program files\MyWebSearch\bar\icons\MFC.ICO
c:\program files\MyWebSearch\bar\icons\PSS.ICO
c:\program files\MyWebSearch\bar\icons\SMILEY.ICO
c:\program files\MyWebSearch\bar\icons\WB.ICO
c:\program files\MyWebSearch\bar\icons\ZWINKY.ICO
c:\program files\MyWebSearch\bar\Message\COMMON.F3S
c:\program files\MyWebSearch\bar\Notifier\COMMON.F3S
c:\program files\MyWebSearch\bar\Notifier\DOG.F3S
c:\program files\MyWebSearch\bar\Notifier\FISH.F3S
c:\program files\MyWebSearch\bar\Notifier\KUNGFU.F3S
c:\program files\MyWebSearch\bar\Notifier\LIFEGARD.F3S
c:\program files\MyWebSearch\bar\Notifier\MAID.F3S
c:\program files\MyWebSearch\bar\Notifier\MAILBOX.F3S
c:\program files\MyWebSearch\bar\Notifier\OPERA.F3S
c:\program files\MyWebSearch\bar\Notifier\ROBOT.F3S
c:\program files\MyWebSearch\bar\Notifier\SEDUCT.F3S
c:\program files\MyWebSearch\bar\Notifier\SURFER.F3S
c:\program files\MyWebSearch\bar\Settings\s_pid.dat
c:\windows\system32\drivers\gasfkykfpqcmtv.sys
c:\windows\system32\f3PSSavr.scr
c:\windows\system32\gasfkybnhkqtpo.dat
c:\windows\system32\gasfkydyuxepiu.dll
c:\windows\system32\gasfkyhmtcunje.dat
c:\windows\system32\gasfkyvqjorpsn.dll
c:\windows\System32\ieHElpmod.dll
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_gasfkyxsimdtwc
-------\Service_gasfkyxsimdtwc
-------\Service_MyWebSearchService
((((((((((((((((((((((((( Files Created from 2009-08-26 to 2009-09-26 )))))))))))))))))))))))))))))))
.
2009-09-24 18:10 . 2009-09-24 18:10 -------- d-----w- c:\users\Robert Hornshaw\AppData\Roaming\Malwarebytes
2009-09-24 18:10 . 2009-09-10 13:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-24 18:09 . 2009-09-24 18:13 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-09-24 18:09 . 2009-09-24 18:09 -------- d-----w- c:\programdata\Malwarebytes
2009-09-24 18:09 . 2009-09-10 13:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-09-24 07:04 . 2009-09-24 07:04 -------- d-----w- c:\program files\Trend Micro
2009-09-23 15:51 . 2009-09-24 16:35 -------- d-----w- c:\users\Robert Hornshaw\AppData\Local\CrashDumps
2009-09-23 14:22 . 2009-09-23 14:29 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-09-23 14:22 . 2009-09-23 14:22 124976 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2009-09-23 14:21 . 2009-09-23 14:21 -------- d-----w- c:\windows\system32\drivers\NAV
2009-09-23 14:21 . 2009-09-23 14:21 -------- d-----w- c:\program files\Norton AntiVirus
2009-09-23 14:21 . 2009-09-23 14:21 -------- d-----w- c:\program files\NortonInstaller
2009-09-20 19:32 . 2009-09-20 19:32 -------- d-----w- c:\programdata\Messenger Plus!
2009-09-20 16:55 . 2009-09-20 16:55 -------- d-----w- c:\program files\Common Files\TSUninstall
2009-09-20 16:53 . 2009-09-25 12:30 -------- d-----w- c:\program files\TS
2009-09-10 08:00 . 2009-08-14 16:27 904776 ----a-w- c:\windows\system32\drivers\tcpip.sys
2009-09-10 08:00 . 2009-08-14 13:49 9728 ----a-w- c:\windows\system32\TCPSVCS.EXE
2009-09-10 08:00 . 2009-08-14 13:49 11264 ----a-w- c:\windows\system32\MRINFO.EXE
2009-09-10 08:00 . 2009-08-14 13:49 27136 ----a-w- c:\windows\system32\NETSTAT.EXE
2009-09-10 08:00 . 2009-08-14 13:49 8704 ----a-w- c:\windows\system32\HOSTNAME.EXE
2009-09-10 08:00 . 2009-08-14 13:49 19968 ----a-w- c:\windows\system32\ARP.EXE
2009-09-10 08:00 . 2009-08-14 13:49 10240 ----a-w- c:\windows\system32\finger.exe
2009-09-10 08:00 . 2009-08-14 13:48 30720 ----a-w- c:\windows\system32\drivers\tcpipreg.sys
2009-09-10 08:00 . 2009-08-14 13:48 105984 ----a-w- c:\windows\system32\netiohlp.dll
2009-09-10 08:00 . 2009-08-14 15:53 17920 ----a-w- c:\windows\system32\netevent.dll
2009-09-10 08:00 . 2009-08-14 13:49 17920 ----a-w- c:\windows\system32\ROUTE.EXE
2009-09-10 07:59 . 2009-07-11 19:01 513536 ----a-w- c:\windows\system32\wlansvc.dll
2009-09-10 07:59 . 2009-07-11 19:01 302592 ----a-w- c:\windows\system32\wlansec.dll
2009-09-10 07:59 . 2009-07-11 19:01 293376 ----a-w- c:\windows\system32\wlanmsm.dll
2009-09-10 07:59 . 2009-07-11 19:01 65024 ----a-w- c:\windows\system32\wlanapi.dll
2009-09-10 07:59 . 2009-07-11 17:03 127488 ----a-w- c:\windows\system32\L2SecHC.dll
2009-09-10 07:59 . 2009-06-10 11:41 2868224 ----a-w- c:\windows\system32\mf.dll
2009-08-28 15:15 . 2009-08-28 15:16 -------- d-----w- c:\windows\system32\ca-ES
2009-08-28 15:15 . 2009-08-28 15:16 -------- d-----w- c:\windows\system32\eu-ES
2009-08-28 15:15 . 2009-08-28 15:16 -------- d-----w- c:\windows\system32\vi-VN
2009-08-28 14:29 . 2009-08-28 14:29 -------- d-----w- c:\windows\system32\EventProviders
2009-08-27 09:30 . 2009-06-22 10:09 2048 ----a-w- c:\windows\system32\tzres.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-25 20:21 . 2009-05-07 03:42 -------- d-----w- c:\programdata\Microsoft Help
2009-09-23 14:22 . 2009-09-23 14:22 805 ----a-w- c:\windows\system32\drivers\SYMEVENT.INF
2009-09-23 14:22 . 2009-09-23 14:22 7443 ----a-w- c:\windows\system32\drivers\SYMEVENT.CAT
2009-09-23 14:22 . 2009-06-21 13:16 -------- d-----w- c:\program files\Symantec
2009-09-23 14:21 . 2009-06-21 13:15 -------- d-----w- c:\programdata\Norton
2009-09-23 14:21 . 2009-06-21 13:09 -------- d-----w- c:\programdata\NortonInstaller
2009-09-20 20:26 . 2009-06-21 13:29 -------- d-----w- c:\programdata\Lx_cats
2009-09-20 16:39 . 2009-08-01 14:56 -------- d-----w- c:\program files\Messenger Plus! Live
2009-09-10 12:11 . 2009-05-07 03:40 -------- d-----w- c:\program files\Microsoft Silverlight
2009-08-28 15:16 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Sidebar
2009-08-28 15:16 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Calendar
2009-08-28 15:16 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-08-28 15:16 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Photo Gallery
2009-08-28 15:16 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Journal
2009-08-28 15:16 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Defender
2009-08-28 15:16 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Collaboration
2009-08-21 11:54 . 2009-05-07 03:28 -------- d-----w- c:\program files\Microsoft Works
2009-08-21 11:10 . 2009-08-15 12:32 -------- d-----w- c:\program files\Google
2009-08-20 15:52 . 2009-06-21 13:17 -------- d-----w- c:\programdata\{7B6BA59A-FB0E-4499-8536-A7420338BF3B}
2009-08-20 15:51 . 2009-06-21 13:17 26600 ----a-r- c:\windows\system32\drivers\GEARAspiWDM.sys
2009-08-20 15:51 . 2009-06-21 13:17 107368 ----a-r- c:\windows\system32\GEARAspi.dll
2009-08-18 13:57 . 2009-08-18 13:57 127832 ----a-w- c:\programdata\SPL2FF6.tmp
2009-08-15 12:32 . 2009-08-15 12:32 -------- d-----w- c:\program files\Common Files\xing shared
2009-08-15 12:32 . 2009-08-15 12:32 -------- d-----w- c:\program files\Common Files\Real
2009-08-15 12:32 . 2009-08-15 12:32 -------- d-----w- c:\program files\Real
2009-08-15 09:14 . 2009-06-22 10:58 40 ----a-w- c:\users\Robert Hornshaw\AppData\Roaming\wklnhst.dat
2009-08-14 12:52 . 2009-08-14 12:52 -------- d-----w- c:\users\Robert Hornshaw\AppData\Roaming\Template
2009-08-06 15:13 . 2009-08-06 15:12 -------- d-----w- c:\programdata\PopCap Games
2009-07-18 16:01 . 2009-07-29 16:09 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-07-18 11:35 . 2009-07-29 16:09 828416 ----a-w- c:\windows\system32\wininet.dll
2009-07-17 13:54 . 2009-08-13 14:33 71680 ----a-w- c:\windows\system32\atl.dll
2009-07-15 12:40 . 2009-08-13 14:32 8147456 ----a-w- c:\windows\system32\wmploc.DLL
2009-07-15 12:39 . 2009-08-13 14:32 313344 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-15 12:39 . 2009-08-13 14:32 4096 ----a-w- c:\windows\system32\dxmasf.dll
2009-07-15 12:39 . 2009-08-13 14:32 7680 ----a-w- c:\windows\system32\spwmp.dll
2009-05-07 11:44 . 2009-05-07 11:41 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-08-20 39408]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2008-12-02 3882312]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-02-23 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-02-23 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-02-23 150552]
"dellsupportcenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2009-01-29 206064]
"diagnostics"="c:\program files\Thomson\ST330\diagnostics\diagnostics.exe" [2009-06-21 557149]
"lxdnmon.exe"="c:\program files\Lexmark 2600 Series\lxdnmon.exe" [2008-03-27 660136]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"nmapp"="c:\program files\Pure Networks\Network Magic\nmapp.exe" [2008-05-21 451896]
"Malwarebytes Anti-Malware (rootkit-scan)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2008-07-18 6246400]
c:\users\Robert Hornshaw\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-2-27 1316192]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2009-05-07 03:31 10536 ----a-w- c:\program files\Citrix\GoToAssist\514\g2awinlogon.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=""
"FirewallOverride"=""
"UpdatesDisableNotify"=""
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):f2,a4,65,52,f3,27,ca,01
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{5A1FA1EA-F1B3-4F58-825A-9EF2803C50A4}"= c:\program files\Windows Live\Sync\WindowsLiveSync.exe:Windows Live Sync
"{C5FAFAD4-C758-4EA6-908E-527BED9310DD}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{6A30DA07-2A55-432B-8F8E-FE84A1F3290C}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{84ED107A-6E5C-431A-829D-969D3ACF964F}"= UDP:c:\temp\Thomson\Installer.exe:SpeedTouch Home Install Wizard
"{A47B9268-E9E5-4940-8C02-078E80032B3C}"= TCP:c:\temp\Thomson\Installer.exe:SpeedTouch Home Install Wizard
"{3DF131A0-5AF2-426F-AE1A-331A27735D67}"= UDP:c:\program files\Thomson\ST330\service\st330service.exe:ST330 service
"{35456785-B615-4850-A193-58D33A10DF3A}"= TCP:c:\program files\Thomson\ST330\service\st330service.exe:ST330 service
"{43CB9605-B552-4483-9723-93F748DE14C4}"= UDP:c:\windows\System32\lxdncoms.exe:Lexmark Communications System
"{27E39C45-709C-46DE-8987-6650ACE0208F}"= TCP:c:\windows\System32\lxdncoms.exe:Lexmark Communications System
"{19D83132-FB43-4313-9931-3D24A132E52A}"= UDP:c:\program files\Lexmark 2600 Series\lxdnamon.exe:Lexmark Device Monitor
"{42A88315-B474-44DE-990F-AE4F2B509E5C}"= TCP:c:\program files\Lexmark 2600 Series\lxdnamon.exe:Lexmark Device Monitor
"{9B284FE5-381C-42DB-9CDA-30DACA0869A7}"= UDP:c:\program files\Lexmark 2600 Series\frun.exe:Lexmark Productivity Studio
"{D566A54C-A5E2-40F0-8EF4-544BAA2D2E1C}"= TCP:c:\program files\Lexmark 2600 Series\frun.exe:Lexmark Productivity Studio
"{BE7CEF1B-2C04-42FA-9DA8-660A35BF6BC2}"= UDP:c:\program files\Lexmark 2600 Series\lxdnmon.exe:Printer Device Monitor
"{D0B5792A-8358-4BBD-B45F-58ACF6F00101}"= TCP:c:\program files\Lexmark 2600 Series\lxdnmon.exe:Printer Device Monitor
"{A0394046-1A7D-435E-9118-38B81838F99A}"= UDP:c:\windows\System32\spool\drivers\w32x86\3\lxdnpswx.exe:Printer Status Window Interface
"{A1A415A1-E5F8-41E9-A153-B2D017884C78}"= TCP:c:\windows\System32\spool\drivers\w32x86\3\lxdnpswx.exe:Printer Status Window Interface
"{44C239BD-DB61-443B-A617-8503C9211135}"= UDP:c:\windows\System32\spool\drivers\w32x86\3\lxdntime.exe:Lexmark Connect Time Executable
"{2CC80878-552E-4CC2-8054-6CE167EA4792}"= TCP:c:\windows\System32\spool\drivers\w32x86\3\lxdntime.exe:Lexmark Connect Time Executable
"{C3DB1580-1139-424D-A3C4-6A08B9576D24}"= UDP:c:\windows\System32\spool\drivers\w32x86\3\lxdnjswx.exe:Job Status Window Interface
"{CCD07AD0-BA84-4124-8D94-E5FA23612659}"= TCP:c:\windows\System32\spool\drivers\w32x86\3\lxdnjswx.exe:Job Status Window Interface
"{A95A1F38-8624-4B66-874F-1D2F6C927D1B}"= TCP:67:DHCP Discovery Service
"{3085A600-4BA7-4923-89F5-2AB2D732A81A}"= UDP:c:\program files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe:Pure Networks Platform Service
"{3803BFC0-5A8B-4C67-922A-1EB8DD9D720B}"= TCP:c:\program files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe:Pure Networks Platform Service
R0 SymDS;Symantec Data Store;c:\windows\System32\drivers\NAV\1100000.088\SymDS.sys [23/09/2009 15:21 328752]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\System32\drivers\NAV\1100000.088\SymEFA.sys [23/09/2009 15:21 169008]
R1 BHDrvx86;BHDrvx86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_17.0.0.136\Definitions\BASHDefs\20090911.001\BHDrvx86.sys [11/09/2009 23:45 507440]
R1 ccHP;Symantec Hash Provider;c:\windows\System32\drivers\NAV\1100000.088\ccHPx86.sys [23/09/2009 15:21 501888]
R1 IDSVix86;IDSVix86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_17.0.0.136\Definitions\IPSDefs\20090911.001\IDSvix86.sys [23/09/2009 16:39 342576]
R1 jswpslwf;JumpStart reƖ Filter Driver;c:\windows\System32\drivers\jswpslwf.sys [01/10/2008 16:44 20384]
R1 SymIRON;Symantec Iron Driver;c:\windows\System32\drivers\NAV\1100000.088\Ironx86.sys [23/09/2009 15:21 114736]
R1 SYMTDIv;Symantec Vista Network Dispatch Driver;c:\windows\System32\drivers\NAV\1100000.088\symtdiv.sys [23/09/2009 15:21 338480]
R2 AERTFilters;Andrea RT Filters Service;c:\windows\System32\AERTSrv.exe [07/05/2009 13:04 73728]
R2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [18/12/2008 13:05 155648]
R2 lxdn_device;lxdn_device;c:\windows\system32\lxdncoms.exe -service --> c:\windows\system32\lxdncoms.exe -service [?]
R2 lxdnCATSCustConnectService;lxdnCATSCustConnectService;c:\windows\System32\spool\drivers\w32x86\3\lxdnserv.exe [28/02/2008 00:07 98984]
R2 NAV;Norton AntiVirus;c:\program files\Norton AntiVirus\Engine\17.0.0.136\ccSvcHst.exe [23/09/2009 15:21 126392]
R2 RtNdPt60;Realtek NDIS Protocol Driver;c:\windows\System32\drivers\RtNdPt60.sys [07/05/2009 04:24 27648]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [24/09/2009 16:13 102448]
R3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI;c:\windows\System32\drivers\IntcHdmi.sys [07/05/2009 13:04 112128]
S2 EraserSvc10922;Symantec Eraser Service;c:\program files\Norton AntiVirus\Engine\17.0.0.136\ccSvcHst.exe [23/09/2009 15:21 126392]
S3 jswpsapi;Jumpstart Wifi Protected Setup;c:\program files\NETGEAR\WN111v2\jswpsapi.exe --> c:\program files\NETGEAR\WN111v2\jswpsapi.exe [?]
S3 PCD5SRVC{3F6A8B78-EC003E00-05040104};PCD5SRVC{3F6A8B78-EC003E00-05040104} - PCDR Kernel Mode Service Helper Driver;c:\progra~1\DELLSU~1\HWDiag\bin\PCD5SRVC.pkms [05/11/2008 00:16 22904]
.
Contents of the 'Scheduled Tasks' folder
2009-09-26 c:\windows\Tasks\RtlNICDiagVistaStart.job
- c:\program files\Realtek\RTNICDiag\RTNICDiag.exe [2009-05-07 11:18]
2009-09-25 c:\windows\Tasks\User_Feed_Synchronization-{3029CC5B-A8AC-4EB4-BEDF-4B0C09E576F6}.job
- c:\windows\system32\msfeedssync.exe [2008-01-21 02:24]
.
.
------- Supplementary Scan -------
.
uStart Page =
hxxp://www.karoo.co.uk/IE: &Search -
http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZJxdm405YYGBIE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
.
- - - - ORPHANS REMOVED - - - -
HKLM-Run-MyWebSearch Plugin - c:\progra~1\MYWEBS~1\bar\1.bin\M3PLUGIN.DLL
AddRemove-TS - c:\program files\TS\tsc.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2009-09-26 08:42
Windows 6.0.6002 Service Pack 2 NTFS
scanning hȋdden processes ...
scanning hȋdden autostart entries ...
scanning hȋdden files ...
scan completed successfully
hȋdden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NAV]
"ImagePath"="\"c:\program files\Norton AntiVirus\Engine\17.0.0.136\ccSvcHst.exe\" /s \"NAV\" /m \"c:\program files\Norton AntiVirus\Engine\17.0.0.136\diMaster.dll\" /prefetch:1"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PCD5SRVC{3F6A8B78-EC003E00-05040104}]
"ImagePath"="\??\c:\progra~1\DELLSU~1\HWDiag\bin\PCD5SRVC.pkms"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\st330service]
"ImagePath"="C:\Program Files/Thomson/ST330/service/st330service.exe -service"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'Explorer.exe'(5244)
c:\program files\Common Files\Pure Networks Shared\Platform\10.2.8216.0.nmcorePS.dll
c:\program files\Pure Networks\Network Magic\nmrsrc.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\System32\audiodg.exe
c:\program files\Thomson\ST330\service\st330service.exe
c:\windows\System32\lxdncoms.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
c:\windows\System32\WUDFHost.exe
c:\windows\System32\dllhost.exe
c:\program files\Dell Support Center\bin\sprtsvc.exe
c:\windows\System32\igfxsrvc.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\Dell Support Center\gs_agent\dsc.exe
c:\windows\System32\wbem\WMIADAP.exe
.
**************************************************************************
.
Completion time: 2009-09-26 8:44 - machine was rebooted
ComboFix-quarantined-files.txt 2009-09-26 07:44
Pre-Run: 447,814,729,728 bytes free
Post-Run: 448,219,844,608 bytes free
308 --- E O F --- 2009-09-10 12:13
