Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Google Redirect Trojan


  • This topic is locked This topic is locked
61 replies to this topic

#1 floydhead73

floydhead73

  • Members
  • 51 posts
  • OFFLINE
  •  
  • Local time:02:19 AM

Posted 17 May 2009 - 12:31 AM

All Google results are redirected to >trap< sites. Norton 360 says I have Backdoor.Trojan, suggests I get help, but Norton doesn't help ~_~ Hopefully, you guys can, because you have in the past ^_^

DDS (Ver_09-05-14.01) - NTFSx86
Run by Taylor at 0:18:27.00 on Sun 05/17/2009
Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_13
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1278.534 [GMT -5:00]

FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\Norton 360\Engine\3.0.0.135\ccSvcHst.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Norton 360\Engine\3.0.0.135\ccSvcHst.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe
C:\Program Files\McAfee\Common Framework\udaterui.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe
C:\Program Files\NETGEAR\MA111 Configuration Utility\wlancfg4.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Last.fm\LastFM.exe
C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtWLan.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\pchealth\helpctr\binaries\helpctr.exe
C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpSvc.exe
C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpHost.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Taylor\Desktop\dds.scr

============== Pseudo HJT Report ===============

uSearch Bar = hxxp://www.google.com/ie
uSearch Page = hxxp://www.google.com
mDefault_Search_URL = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Symantec NCO BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - c:\program files\norton 360\engine\3.0.0.135\coIEPlg.dll
BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\program files\norton 360\engine\3.0.0.135\IPSBHO.DLL
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.3572\swg.dll
BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll
BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\googleafe\GoogleAE.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll
TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - c:\program files\norton 360\engine\3.0.0.135\coIEPlg.dll
TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File
TB: {5CBE2611-C31B-401F-89BC-4CBB25E853D7} - No File
TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File
EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe
mRun: [SoundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe
mRun: [IntelMeM] c:\program files\intel\modem event monitor\IntelMEM.exe
mRun: [DVDLauncher] "c:\program files\cyberlink\powerdvd\DVDLauncher.exe"
mRun: [RealTray] c:\program files\real\realplayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
mRun: [ISUSPM Startup] "c:\program files\common files\installshield\updateservice\isuspm.exe" -startup
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [nwiz] nwiz.exe /install
mRun: [igfxtray] c:\windows\system32\igfxtray.exe
mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe
mRun: [igfxpers] c:\windows\system32\igfxpers.exe
mRun: [IPHSend] c:\program files\common files\aol\iphsend\IPHSend.exe
mRun: [DAEMON Tools] "c:\program files\daemon tools\daemon.exe" -lang 1033
mRun: [ISUSPM] "c:\program files\common files\installshield\updateservice\isuspm.exe" -scheduler
mRun: [McAfeeUpdaterUI] "c:\program files\mcafee\common framework\udaterui.exe" /StartedFromRunKey
mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
mRun: [IMEKRMIG6.1] c:\windows\ime\imkr6_1\IMEKRMIG.EXE
mRun: [MSPY2002] c:\windows\system32\ime\pintlgnt\ImScInst.exe /SYNC
mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC
mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [SoundMan] SOUNDMAN.EXE
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
dRun: [ALUAlert] c:\program files\symantec\liveupdate\ALUNotify.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\kodake~1.lnk - c:\program files\kodak\kodak easyshare software\bin\EasyShare.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\kodaks~1.lnk - c:\program files\kodak\kodak software updater\7288971\program\Kodak Software Updater.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\ma111c~1.lnk - c:\program files\netgear\ma111 configuration utility\wlancfg.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\wg111v~1.lnk - c:\program files\netgear\wg111v2 configuration utility\RtlWake.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office10\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
DPF: {33564D57-0000-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-160-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
TCP: NameServer = 85.255.112.66,85.255.112.131
TCP: {13DC48F3-EE60-498B-B7D6-735B095C865F} = 85.255.112.66,85.255.112.131
TCP: {65351AB2-5490-489B-8FA3-17745C931627} = 85.255.112.66,85.255.112.131
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Handler: symres - {AA1061FE-6C41-421f-9344-69640C9732AB} - c:\program files\norton 360\engine\3.0.0.135\CoIEPlg.dll
Notify: igfxcui - igfxdev.dll
SEH: CShellExecuteHookImpl Object: {54d9498b-cf93-414f-8984-8ce7fde0d391} - c:\program files\ewido anti-malware\shellhook.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\taylor\applic~1\mozilla\firefox\profiles\larpsyty.default\
FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=tb50fftrie7&query=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.google.com
FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=tb50fftrab&query=
FF - component: c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\coffplgn\components\coFFPlgn.dll
FF - component: c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\ipsffplgn\components\IPSFFPl.dll
FF - plugin: c:\documents and settings\taylor\application data\mozilla\firefox\profiles\larpsyty.default\extensions\moveplayer@movenetworks.com\platform\winnt_x86-msvc\plugins\npmnqmp071303000006.dll
FF - plugin: c:\program files\gametap\bin\release\npgametaptool.dll
FF - plugin: c:\program files\google\google updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdnu.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npmozax.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npqtplugin8.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npunagi2.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\quicktime\plugins\npqtplugin8.dll
FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll

============= SERVICES / DRIVERS ===============

R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\n360\0300000.087\SymEFA.sys [2009-5-15 310320]
R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\n360\0300000.087\BHDrvx86.sys [2009-5-15 258608]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\n360\0300000.087\cchpx86.sys [2009-5-15 482352]
R1 IDSxpx86;IDSxpx86;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\ipsdefs\20090508.002\IDSXpx86.sys [2009-5-15 276344]
R2 aawservice;Ad-Aware 2007 Service;c:\program files\lavasoft\ad-aware 2007\aawservice.exe [2007-10-29 607576]
R2 EAPPkt;Realtek EAPPkt Protocol;c:\windows\system32\drivers\EAPPkt.sys [2006-1-11 66048]
R2 ewido security suite control;ewido security suite control;c:\program files\ewido anti-malware\ewidoctrl.exe [2005-11-30 13888]
R2 McAfeeFramework;McAfee Framework Service;c:\program files\mcafee\common framework\FrameworkService.exe [2008-3-14 103744]
R2 N360;Norton 360;c:\program files\norton 360\engine\3.0.0.135\ccSvcHst.exe [2009-5-15 115560]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2008-3-23 24652]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2009-5-15 101936]
R3 NAVENG;NAVENG;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\virusdefs\20090516.019\NAVENG.SYS [2009-5-16 89104]
R3 NAVEX15;NAVEX15;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\virusdefs\20090516.019\NAVEX15.SYS [2009-5-16 876144]
R3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;c:\windows\system32\drivers\wg111v2.sys [2007-4-7 272128]
R3 SjyPkt;SjyPkt;c:\windows\system32\drivers\SjyPkt.sys [2007-4-7 13532]
S1 mferkdk;VSCore mferkdk;\??\c:\program files\mcafee\virusscan enterprise\mferkdk.sys --> c:\program files\mcafee\virusscan enterprise\mferkdk.sys [?]
S3 cpuz132;cpuz132;c:\windows\system32\drivers\cpuz132_x32.sys [2009-4-28 12672]

============== File Associations ===============

regfile=*** no open command defined ***

=============== Created Last 30 ================

2009-05-17 00:11 <DIR> -cdshr-- C:\autorun.inf
2009-05-15 14:26 <DIR> --d----- c:\program files\Norton Support
2009-05-15 14:15 <DIR> --d----- c:\docume~1\alluse~1\applic~1\{7B6BA59A-FB0E-4499-8536-A7420338BF3B}
2009-05-15 14:15 36,400 a----r-- c:\windows\system32\drivers\SymIM.sys
2009-05-15 14:14 2,524 ac------ C:\autorun.PNF
2009-05-15 14:14 124,464 a------- c:\windows\system32\drivers\SYMEVENT.SYS
2009-05-15 14:14 60,808 a------- c:\windows\system32\S32EVNT1.DLL
2009-05-15 14:14 7,386 a------- c:\windows\system32\drivers\SYMEVENT.CAT
2009-05-15 14:14 805 a------- c:\windows\system32\drivers\SYMEVENT.INF
2009-05-15 14:13 <DIR> --d----- c:\windows\system32\drivers\N360
2009-05-15 14:13 <DIR> --d----- c:\program files\Norton 360
2009-05-15 14:13 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Norton
2009-05-15 14:13 <DIR> --d----- c:\program files\NortonInstaller
2009-05-15 14:13 <DIR> --d----- c:\docume~1\alluse~1\applic~1\NortonInstaller
2009-05-15 14:05 <DIR> --d----- c:\docume~1\taylor\applic~1\GetRightToGo
2009-05-14 10:33 52,224 a------- c:\windows\ipuninst.exe
2009-05-14 10:31 <DIR> --d----- c:\program files\Interplay
2009-05-13 16:11 <DIR> --d----- c:\docume~1\taylor\applic~1\Any Video Converter
2009-05-13 16:11 <DIR> --d----- c:\program files\Any Video Converter
2009-04-28 22:48 12,672 a------- c:\windows\system32\drivers\cpuz132_x32.sys
2009-04-28 22:48 <DIR> --d----- c:\program files\CPUID
2009-04-23 18:44 <DIR> --d----- c:\docume~1\alluse~1\applic~1\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}

==================== Find3M ====================

2009-04-19 22:19 43,520 a------- c:\windows\system32\CmdLineExt03.dll
2009-03-21 09:06 989,696 -------- c:\windows\system32\dllcache\kernel32.dll
2009-03-19 15:32 23,400 a------- c:\windows\system32\drivers\GEARAspiWDM.sys
2009-03-09 04:19 410,984 a------- c:\windows\system32\deploytk.dll
2009-03-06 09:22 284,160 a------- c:\windows\system32\pdh.dll
2009-03-06 09:22 284,160 -------- c:\windows\system32\dllcache\pdh.dll
2009-03-02 18:04 1,499,136 -------- c:\windows\system32\dllcache\shdocvw.dll
2009-02-20 03:11 3,068,416 -------- c:\windows\system32\dllcache\mshtml.dll
2009-02-20 03:10 666,112 a------- c:\windows\system32\wininet.dll
2009-02-20 03:10 666,112 -------- c:\windows\system32\dllcache\wininet.dll
2009-02-20 03:10 619,520 -------- c:\windows\system32\dllcache\urlmon.dll
2009-02-20 03:10 81,920 a------- c:\windows\system32\ieencode.dll
2009-02-20 03:10 81,920 -------- c:\windows\system32\dllcache\ieencode.dll
2008-10-26 11:59 39,832 ac------ c:\docume~1\taylor\applic~1\GDIPFONTCACHEV1.DAT
2006-11-27 20:33 7,486,189 ac------ c:\program files\programfiles.zip

============= FINISH: 0:19:16.00 ===============

Attached Files



BC AdBot (Login to Remove)

 


#2 SifuMike

SifuMike

    malware expert


  • Members
  • 15,385 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Vancouver (not BC) WA (Not DC) USA
  • Local time:12:19 AM

Posted 19 May 2009 - 06:48 PM

Hello floydhead73,

You have the latest Java™ 6 Update 13 but you need to
uninstall these old versions of Java,

Java™ 6 Update 2
Java™ 6 Update 3
Java™ 6 Update 5
Java™ 6 Update 7



Please download Malwarebytes' Anti-Malware from one of these places:
http://download.cnet.com/Malwarebytes-Anti...&tag=button
http://www.majorgeeks.com/Malwarebytes_Ant...ware_d5756.html
http://www.besttechie.net/mbam/mbam-setup.exe

Double Click mbam-setup.exe to install the application.

* Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select "Perform Quick Scan", then click Scan.
* The scan may take some time to finish,so please be patient.
* When the scan is complete, click OK, then Show Results to view the results.
* Make sure that everything is checked, and click Remove Selected.
* When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
* The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
* Copy&Paste the entire MBAM report (even if it does not find anything) in your next reply .

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.




Please download GooredFix and save it to your Desktop.
Double-click Goored.exe to run it. Select 1.
Find Goored (no fix)
by typing 1 and pressing Enter.
A log will open, please post the contents of that log in your next reply (it can also be found on your desktop, called GooredLog.txt).
Note: Do not run Option #2 yet.
If I've saved you time & money,
please make a donation so I can keep helping people just like you! You can donate using a credit card and PayPal. Thank you!



Posted Image

Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#3 floydhead73

floydhead73
  • Topic Starter

  • Members
  • 51 posts
  • OFFLINE
  •  
  • Local time:02:19 AM

Posted 19 May 2009 - 10:12 PM

After I removed the old versions of Java, I installed Malwarebytes' Anti-Malware. Unfortunately, after setup, the program neither updated nor launched, even when I tried to open it from the desktop icon or Start menu. After reinstalling it and getting the same results, I decided to uninstall it again and reboot my computer. When Windows launched, I was greeted with an error message: C:/Program cannot be found. Fantastic. Malwarebytes' Anti-Malware still doesn't launch.

#4 SifuMike

SifuMike

    malware expert


  • Members
  • 15,385 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Vancouver (not BC) WA (Not DC) USA
  • Local time:12:19 AM

Posted 19 May 2009 - 10:15 PM

Hello floydhead73


If MBAM will not install, please rename the installer mbam-setup.exe. Example: newtool.exe
Proceed installing the renamed installer of MBAM.

If MBAM will not run, go to the program directory of MBAM (e.g. C:\Program FIles\Malwarebytes Antimalware\) then rename mbam.exe to newtool.exe, double click newtool.exe to proceed in running a quick scan.
If I've saved you time & money,
please make a donation so I can keep helping people just like you! You can donate using a credit card and PayPal. Thank you!



Posted Image

Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#5 floydhead73

floydhead73
  • Topic Starter

  • Members
  • 51 posts
  • OFFLINE
  •  
  • Local time:02:19 AM

Posted 20 May 2009 - 09:34 AM

Malwarebytes' Anti-Malware 1.36
Database version: 1945
Windows 5.1.2600 Service Pack 3

5/20/2009 9:21:41 AM
mbam-log-2009-05-20 (09-21-41).txt

Scan type: Quick Scan
Objects scanned: 75056
Time elapsed: 4 minute(s), 56 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 8
Registry Values Infected: 1
Registry Data Items Infected: 12
Folders Infected: 1
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{9034a523-d068-4be8-a284-9df278be776e} (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{5929cd6e-2062-44a4-b2c5-2c7e78fbab38} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6fd31ed6-7c94-4bbc-8e95-f927f4d3a949} (Adware.180Solutions) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{8fcdf9d9-a28b-480f-8c3d-581f119a8ab8} (Adware.180Solutions) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{daed9266-8c28-4c1c-8b58-5c66eff1d302} (Search.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{90b5a95a-afd5-4d11-b9bd-a69d53d22226} (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8109fd3d-d891-4f80-8339-50a4913ace6f} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Trymedia Systems (Adware.Trymedia) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow\*.securewebinfo.com (Trojan.Zlob) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.66,85.255.112.131 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{13dc48f3-ee60-498b-b7d6-735b095c865f}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.66,85.255.112.131 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{65351ab2-5490-489b-8fa3-17745c931627}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.66,85.255.112.131 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{65351ab2-5490-489b-8fa3-17745c931627}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.66,85.255.112.131 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.66,85.255.112.131 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\Interfaces\{13dc48f3-ee60-498b-b7d6-735b095c865f}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.66,85.255.112.131 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\Interfaces\{65351ab2-5490-489b-8fa3-17745c931627}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.66,85.255.112.131 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\Interfaces\{65351ab2-5490-489b-8fa3-17745c931627}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.66,85.255.112.131 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.66,85.255.112.131 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\Tcpip\Parameters\Interfaces\{13dc48f3-ee60-498b-b7d6-735b095c865f}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.66,85.255.112.131 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\Tcpip\Parameters\Interfaces\{65351ab2-5490-489b-8fa3-17745c931627}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.66,85.255.112.131 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\Tcpip\Parameters\Interfaces\{65351ab2-5490-489b-8fa3-17745c931627}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.66,85.255.112.131 -> Quarantined and deleted successfully.

Folders Infected:
C:\Documents and Settings\Taylor\Application Data\m (Trojan.Agent) -> Quarantined and deleted successfully.

Files Infected:
C:\Documents and Settings\Taylor\Application Data\m\Thumbs.db (Trojan.Agent) -> Quarantined and deleted successfully.
C:\RECYCLER\S-7-1-67-100014635-100023993-100010482-9041.com (Trojan.Agent) -> Quarantined and deleted successfully.

----------------------------------------------------------------------------------------------------------------------------------------------------
GooredFix v1.92 by jpshortstuff
Log created at 09:31 on 20/05/2009 running Option #1 (Taylor)
Firefox version 3.0.10 (en-US)

=====Suspect Goored Entries=====

=====Dumping Registry Values=====

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.10\extensions]
"Plugins"="C:\Program Files\Mozilla Firefox\plugins"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.10\extensions]
"Components"="C:\Program Files\Mozilla Firefox\components"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
"jqs@sun.com"="C:\Program Files\Java\jre6\lib\deploy\jqs\ff"

#6 SifuMike

SifuMike

    malware expert


  • Members
  • 15,385 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Vancouver (not BC) WA (Not DC) USA
  • Local time:12:19 AM

Posted 20 May 2009 - 10:09 AM

Hi floydhead73,

Database version: 1945



You need to update Malwarebytes and run it again. The latest Database version is 2157.

If you can't update MBAM, manually download the database installer from http://malwarebytes.gt500.org/mbam-rules.exe
See also: http://malwarebytes.gt500.org/database.jsp

Post the log it produces.
If I've saved you time & money,
please make a donation so I can keep helping people just like you! You can donate using a credit card and PayPal. Thank you!



Posted Image

Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#7 floydhead73

floydhead73
  • Topic Starter

  • Members
  • 51 posts
  • OFFLINE
  •  
  • Local time:02:19 AM

Posted 20 May 2009 - 05:54 PM

I had to manually download the update. Firewall wouldn't allow it as an exception, and,even with Firewall down, the program couldn't access the internet. So the Database version is 2110. Sorry

Malwarebytes' Anti-Malware 1.36
Database version: 2110
Windows 5.1.2600 Service Pack 3

5/20/2009 5:44:11 PM
mbam-log-2009-05-20 (17-44-11).txt

Scan type: Quick Scan
Objects scanned: 85655
Time elapsed: 4 minute(s), 26 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{b8c5186e-ec37-4889-9c2e-f73649ffb7bb} (Trojan.Zlob) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\gxvxccounter (Trojan.DNSchanger) -> Quarantined and deleted successfully.

#8 SifuMike

SifuMike

    malware expert


  • Members
  • 15,385 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Vancouver (not BC) WA (Not DC) USA
  • Local time:12:19 AM

Posted 20 May 2009 - 06:47 PM

Hi floydhead73,

We will run ComobFix.

You should NOT use Combofix unless you have been instructed to do so by a Malware Removal Expert.
It is intended by its creator to be used under the guidance and supervision of an Malware Removal Expert, not for private use.

Using this tool incorrectly could lead to disastrous problems with your operating system such as preventing it from ever starting again.
Please read Combofix's Disclaimer.
Further, ComboFix logs are not permitted outside the HijackThis forums and then only when requested by a HJT Team member.

You need to disable your Norton 360 Antivirus before running ComboFix, as it will prevent it from running.

Note: If you already have a copy of ComboFix on your system it is essential that you delete it before downloading this copy.

Please visit this webpage for instructions for downloading and running ComboFix:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix

To work properly, you must install ComboFix on the Desktop..
Post the log from ComboFix in your next reply,

A caution - ComboFix may reset a number of Internet Explorer's settings, including making IE the default browser.
ComboFix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal and increase security. If this is an issue or makes it difficult for you -- please tell me.
Have no other programs running. Your Task Bar should be clear of any program entries including your Browser.
Do not run Combofix more than once.
Do not touch your mouse/keyboard until the scan has completed, as this may cause the process to stall or your computer to lock.
The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs, please reboot to restore the desktop.
Even when ComboFix appears to be doing nothing, look at your Drive light. If it is flashing, Combofix is still at work.

Edited by SifuMike, 20 May 2009 - 06:48 PM.
typo

If I've saved you time & money,
please make a donation so I can keep helping people just like you! You can donate using a credit card and PayPal. Thank you!



Posted Image

Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#9 floydhead73

floydhead73
  • Topic Starter

  • Members
  • 51 posts
  • OFFLINE
  •  
  • Local time:02:19 AM

Posted 22 May 2009 - 11:18 AM

ComboFix 09-05-21.05 - Taylor 05/22/2009 11:00.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1278.915 [GMT -5:00]
Running from: c:\documents and settings\Taylor\Desktop\ComboFix.exe
FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\drivers\gxvxcjgoyuyakdlfsowqgrkdulhboaitbiqho.sys
c:\windows\system32\drivers\gxvxcnxusqeeadbtuanvspraamjtryordrddf.sys
c:\windows\system32\drivers\gxvxcqcwtaitpvpppkrgomomnvnxeylkytwrr.sys
c:\windows\system32\drivers\gxvxcqjlhbqlxmupxwirmgkbwppkcewpjxujd.sys
c:\windows\system32\drivers\gxvxcsqtehhbfdlobbwykmxdqjbpfqrgalkqr.sys
c:\windows\system32\drivers\gxvxcuufoawykrxvaivkdvwpyorjnpjvxjmwo.sys
c:\windows\system32\dumphive.exe
c:\windows\system32\gxvxccounter
c:\windows\system32\gxvxcqjxvkriybtpyounuuoqkdsxmoiydidwd.dll
c:\windows\system32\Process.exe
c:\windows\system32\SrchSTS.exe
c:\windows\system32\tmp.reg
c:\windows\system32\VCCLSID.exe
c:\windows\system32\WS2Fix.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_GXVXCSERV.SYS


((((((((((((((((((((((((( Files Created from 2009-04-22 to 2009-05-22 )))))))))))))))))))))))))))))))
.

2009-05-22 15:55 . 2009-05-15 19:14 165240 ----a-r c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\IPSFFPlgn\components\IPSFFPl.dll
2009-05-22 15:36 . 2009-05-15 19:14 89104 ----a-w c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090522.002\NAVENG.SYS
2009-05-22 15:36 . 2009-05-15 19:14 876144 ----a-w c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090522.002\NAVEX15.SYS
2009-05-22 15:36 . 2009-05-15 19:14 177520 ----a-w c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090522.002\NAVENG32.DLL
2009-05-22 15:36 . 2009-05-15 19:14 1181040 ----a-w c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090522.002\NAVEX32A.DLL
2009-05-22 15:36 . 2009-05-15 19:14 371248 ----a-w c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090522.002\EECTRL.SYS
2009-05-22 15:36 . 2009-05-15 19:14 101936 ----a-w c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090522.002\ERASER.SYS
2009-05-22 15:36 . 2009-05-15 19:14 259368 ----a-w c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090522.002\ECMSVR32.DLL
2009-05-22 15:36 . 2009-05-15 19:14 2414128 ----a-w c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090522.002\CCERASER.DLL
2009-05-20 06:37 . 2009-05-20 06:37 -------- d-----w c:\documents and settings\Taylor\Application Data\Malwarebytes
2009-05-20 03:05 . 2009-04-06 20:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-05-20 03:05 . 2009-04-06 20:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-20 03:05 . 2009-05-20 06:37 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-05-20 03:05 . 2009-05-20 03:05 -------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-05-19 19:01 . 2009-05-15 19:14 396848 ----a-w c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090513.001\IDSviA64.sys
2009-05-19 19:01 . 2009-05-15 19:14 292912 ----a-w c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090513.001\IDSvix86.sys
2009-05-19 19:01 . 2009-05-15 19:14 276344 ----a-w c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090513.001\IDSXpx86.sys
2009-05-19 19:01 . 2009-05-15 19:14 447864 ----a-w c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090513.001\IDSxpx86.dll
2009-05-19 19:01 . 2009-03-16 20:03 533880 ----a-w c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090513.001\Scxpx86.dll
2009-05-19 15:04 . 2009-05-19 15:04 -------- d-----w c:\program files\Xvid
2009-05-19 15:04 . 2008-12-05 02:46 180224 ----a-w c:\windows\system32\xvidvfw.dll
2009-05-19 15:04 . 2008-12-05 02:42 815104 ----a-w c:\windows\system32\xvidcore.dll
2009-05-15 19:26 . 2009-05-15 19:26 -------- d-----w c:\program files\Norton Support
2009-05-15 19:26 . 2009-05-15 19:26 -------- d-----w c:\documents and settings\Taylor\Local Settings\Application Data\Symantec
2009-05-15 19:23 . 2009-05-15 19:14 396848 ----a-w c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090508.002\IDSviA64.sys
2009-05-15 19:23 . 2009-05-15 19:14 292912 ----a-w c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090508.002\IDSvix86.sys
2009-05-15 19:23 . 2009-05-15 19:14 276344 ----a-w c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090508.002\IDSXpx86.sys
2009-05-15 19:23 . 2009-05-15 19:14 447864 ----a-w c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090508.002\IDSxpx86.dll
2009-05-15 19:23 . 2009-03-16 20:03 533880 ----a-w c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090508.002\Scxpx86.dll
2009-05-15 19:15 . 2009-05-15 19:14 554352 ----a-r c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\components\coFFPlgn.dll
2009-05-15 19:15 . 2009-05-15 19:15 -------- d-----w c:\documents and settings\All Users\Application Data\{7B6BA59A-FB0E-4499-8536-A7420338BF3B}
2009-05-15 19:15 . 2009-05-15 19:14 36400 ----a-r c:\windows\system32\drivers\SymIM.sys
2009-05-15 19:14 . 2009-05-15 19:14 60808 ----a-w c:\windows\system32\S32EVNT1.DLL
2009-05-15 19:14 . 2009-05-15 19:14 124464 ----a-w c:\windows\system32\drivers\SYMEVENT.SYS
2009-05-15 19:14 . 2009-05-15 19:14 396848 ----a-w c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\IDSvia64.sys
2009-05-15 19:14 . 2009-05-15 19:14 292912 ----a-w c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\IDSvix86.sys
2009-05-15 19:14 . 2009-05-15 19:14 276344 ----a-w c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\IDSxpx86.sys
2009-05-15 19:14 . 2009-05-15 19:14 1290592 ----a-w c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\SyKnAppS\SyKnAppS.dll
2009-05-15 19:14 . 2009-05-15 19:14 136840 ----a-w c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\SyKnAppS\patch25.dll
2009-05-15 19:14 . 2009-05-15 19:14 447864 ----a-w c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\idsxpx86.dll
2009-05-15 19:14 . 2009-05-15 19:14 796016 ----a-w c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\CLT\cltLMSx.dll
2009-05-15 19:13 . 2009-05-15 19:13 -------- d-----w c:\windows\system32\drivers\N360
2009-05-15 19:13 . 2009-05-15 19:14 -------- d-----w c:\program files\Norton 360
2009-05-15 19:13 . 2009-05-15 19:13 -------- d-----w c:\program files\Windows Sidebar
2009-05-15 19:13 . 2009-05-15 19:15 -------- d-----w c:\documents and settings\All Users\Application Data\Norton
2009-05-15 19:13 . 2009-05-15 19:13 -------- d-----w c:\documents and settings\All Users\Application Data\NortonInstaller
2009-05-15 19:13 . 2009-05-15 19:13 -------- d-----w c:\program files\NortonInstaller
2009-05-15 19:05 . 2009-05-15 19:20 -------- d-----w c:\documents and settings\Taylor\Application Data\GetRightToGo
2009-05-14 15:33 . 2009-05-14 15:33 52224 ----a-w c:\windows\ipuninst.exe
2009-05-14 15:31 . 2009-05-14 15:31 -------- d-----w c:\program files\Interplay
2009-05-13 21:11 . 2009-05-13 21:33 -------- d-----w c:\documents and settings\Taylor\Application Data\Any Video Converter
2009-05-13 21:11 . 2009-05-13 21:33 -------- d-----w c:\program files\Any Video Converter
2009-05-13 18:09 . 2009-05-14 15:28 -------- d-----w c:\documents and settings\LocalService\Local Settings\Application Data\Google
2009-04-29 03:48 . 2009-04-29 03:48 -------- d-----w c:\program files\CPUID
2009-04-29 03:48 . 2009-03-27 05:16 12672 ----a-w c:\windows\system32\drivers\cpuz132_x32.sys
2009-04-27 22:47 . 2009-03-09 15:34 971776 ----a-w c:\documents and settings\Taylor\Application Data\Mozilla\Firefox\Profiles\larpsyty.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071303000006.dll
2009-04-23 23:44 . 2009-04-23 23:45 -------- d-----w c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-21 22:24 . 2008-11-25 02:40 -------- d-----w c:\documents and settings\All Users\Application Data\Google Updater
2009-05-20 02:37 . 2006-01-10 21:58 -------- d-----w c:\program files\Java
2009-05-18 05:54 . 2008-08-18 22:31 664 ----a-w c:\windows\system32\d3d9caps.dat
2009-05-16 15:06 . 2006-02-01 03:45 -------- d-----w c:\documents and settings\All Users\Application Data\Symantec
2009-05-15 19:14 . 2006-02-01 03:45 -------- d-----w c:\program files\Symantec
2009-05-15 19:14 . 2009-05-15 19:14 805 ----a-w c:\windows\system32\drivers\SYMEVENT.INF
2009-05-15 19:14 . 2009-05-15 19:14 7386 ----a-w c:\windows\system32\drivers\SYMEVENT.CAT
2009-05-15 19:14 . 2006-02-01 03:45 -------- d-----w c:\program files\Common Files\Symantec Shared
2009-04-23 23:45 . 2009-03-28 16:43 -------- d-----w c:\program files\iTunes
2009-04-23 23:44 . 2006-01-14 18:36 -------- d-----w c:\program files\iPod
2009-04-23 23:44 . 2007-08-19 04:47 -------- d-----w c:\program files\Common Files\Apple
2009-04-20 03:19 . 2007-12-09 17:41 43520 ----a-w c:\windows\system32\CmdLineExt03.dll
2009-04-13 05:36 . 2007-11-04 21:39 -------- d-----w c:\program files\Warcraft III
2009-04-13 05:32 . 2008-06-04 19:20 -------- d-----w c:\program files\MobMapUpdater
2009-04-13 05:28 . 2006-01-10 22:00 -------- d--h--w c:\program files\InstallShield Installation Information
2009-04-13 05:26 . 2006-03-12 20:19 -------- d-----w c:\program files\LimeWire Acceleration Patch
2009-04-13 05:26 . 2007-09-01 00:49 -------- d-----w c:\program files\LimeWire
2009-04-13 05:25 . 2006-03-01 23:16 -------- d-----w c:\program files\EphPod
2009-04-13 05:24 . 2006-01-15 19:34 -------- d-----w c:\program files\Doom Shareware for Windows 95
2009-04-13 05:23 . 2006-01-10 22:13 -------- d-----w c:\program files\Google
2009-04-12 22:08 . 2008-08-22 22:14 -------- d-----w c:\documents and settings\Taylor\Application Data\Skype
2009-04-12 22:07 . 2008-03-19 19:52 -------- d-----w c:\program files\Steam
2009-04-12 21:58 . 2009-04-12 21:58 -------- d-----w c:\program files\Realtek AC97
2009-04-12 21:28 . 2008-08-22 22:15 -------- d-----w c:\documents and settings\Taylor\Application Data\skypePM
2009-04-04 18:06 . 2009-04-04 18:06 -------- d-----w c:\documents and settings\Taylor\Application Data\Pegasys Inc
2009-04-04 17:48 . 2006-10-13 17:42 -------- d-----w c:\program files\DivX
2009-04-02 20:29 . 2009-04-02 20:29 75048 ----a-w c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.1.1.10\SetupAdmin.exe
2009-03-31 22:02 . 2009-03-31 22:02 57344 ----a-w c:\documents and settings\Taylor\Application Data\Sun\Java\Deployment\cache\6.0\50\5b902232-44bb3962-n\Decora-SSE.dll
2009-03-31 22:02 . 2009-03-31 22:02 24064 ----a-w c:\documents and settings\Taylor\Application Data\Sun\Java\Deployment\cache\6.0\15\4e09eacf-178b75ad-n\Decora-D3D.dll
2009-03-31 22:02 . 2009-03-31 22:02 499712 ----a-w c:\documents and settings\Taylor\Application Data\Sun\Java\Deployment\cache\6.0\33\258cea61-791e531e-n\msvcp71.dll
2009-03-31 22:02 . 2009-03-31 22:02 499712 ----a-w c:\documents and settings\Taylor\Application Data\Sun\Java\Deployment\cache\6.0\33\258cea61-791e531e-n\jmc.dll
2009-03-31 22:02 . 2009-03-31 22:02 348160 ----a-w c:\documents and settings\Taylor\Application Data\Sun\Java\Deployment\cache\6.0\33\258cea61-791e531e-n\msvcr71.dll
2009-03-31 22:00 . 2009-03-31 22:00 152576 ----a-w c:\documents and settings\Taylor\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-03-31 11:23 . 2009-03-31 09:29 0 ----a-w c:\documents and settings\Taylor\Local Settings\Application Data\d3d9caps.dat
2009-03-31 10:16 . 2009-03-31 10:16 0 ----a-w c:\documents and settings\Taylor\Local Settings\Application Data\d3d9caps.tmp
2009-03-30 05:49 . 2009-03-30 05:40 -------- d-----w c:\program files\Last.fm
2009-03-30 05:42 . 2009-03-30 05:42 92 ----a-w c:\documents and settings\All Users\Application Data\Last.fm\Client\uninst2.bat
2009-03-30 05:42 . 2009-03-30 05:42 -------- d-----w c:\documents and settings\All Users\Application Data\Last.fm
2009-03-30 05:42 . 2009-03-30 05:42 683801 ----a-w c:\documents and settings\All Users\Application Data\Last.fm\Client\UninstITW\unins000.exe
2009-03-28 16:44 . 2009-03-28 16:43 -------- d-----w c:\documents and settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
2009-03-28 16:40 . 2009-03-28 16:40 -------- d-----w c:\program files\Bonjour
2009-03-28 16:39 . 2008-03-19 20:37 -------- d-----w c:\program files\QuickTime
2009-03-27 01:29 . 2008-08-17 19:08 -------- d-----w c:\program files\McAfee
2009-03-27 01:29 . 2008-08-17 19:08 -------- d-----w c:\documents and settings\All Users\Application Data\McAfee
2009-03-19 20:32 . 2009-03-19 20:32 23400 ----a-w c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}\x86\x86\GEARAspiWDM.sys
2009-03-19 20:32 . 2006-09-19 21:44 23400 ----a-w c:\windows\system32\drivers\GEARAspiWDM.sys
2009-03-16 20:03 . 2009-03-16 20:03 533880 ----a-w c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\Scxpx86.dll
2009-03-09 09:19 . 2009-02-24 15:35 410984 ----a-w c:\windows\system32\deploytk.dll
2009-03-06 14:22 . 2004-08-10 18:51 284160 ----a-w c:\windows\system32\pdh.dll
2009-02-24 15:35 . 2009-02-24 15:35 57344 ----a-w c:\documents and settings\Taylor\Application Data\Sun\Java\Deployment\cache\6.0\37\3976f065-52b43953-n\Decora-SSE.dll
2009-02-24 15:35 . 2009-02-24 15:35 24064 ----a-w c:\documents and settings\Taylor\Application Data\Sun\Java\Deployment\cache\6.0\37\2c4a0065-577397ec-n\Decora-D3D.dll
2009-02-24 15:35 . 2009-02-24 15:35 315392 ----a-w c:\documents and settings\Taylor\Application Data\Sun\Java\Deployment\cache\6.0\62\6baea4fe-5faca69a-n\jogl.dll
2009-02-24 15:35 . 2009-02-24 15:35 20480 ----a-w c:\documents and settings\Taylor\Application Data\Sun\Java\Deployment\cache\6.0\62\6baea4fe-5faca69a-n\jogl_awt.dll
2009-02-24 15:35 . 2009-02-24 15:35 114688 ----a-w c:\documents and settings\Taylor\Application Data\Sun\Java\Deployment\cache\6.0\62\6baea4fe-5faca69a-n\jogl_cg.dll
2009-02-24 15:35 . 2009-02-24 15:35 20480 ----a-w c:\documents and settings\Taylor\Application Data\Sun\Java\Deployment\cache\6.0\45\4f710eed-18a0b40c-n\gluegen-rt.dll
2009-02-24 15:35 . 2009-02-24 15:35 503808 ----a-w c:\documents and settings\Taylor\Application Data\Sun\Java\Deployment\cache\6.0\38\39ba6e6-7c52fdf5-n\msvcp71.dll
2009-02-24 15:35 . 2009-02-24 15:35 499712 ----a-w c:\documents and settings\Taylor\Application Data\Sun\Java\Deployment\cache\6.0\38\39ba6e6-7c52fdf5-n\jmc.dll
2009-02-24 15:35 . 2009-02-24 15:35 348160 ----a-w c:\documents and settings\Taylor\Application Data\Sun\Java\Deployment\cache\6.0\38\39ba6e6-7c52fdf5-n\msvcr71.dll
2009-02-24 15:33 . 2009-02-24 15:33 152576 ----a-w c:\documents and settings\Taylor\Application Data\Sun\Java\jre1.6.0_11\lzma.dll
2006-11-28 01:33 . 2008-08-18 16:09 7486189 -c--a-w c:\program files\programfiles.zip
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-03 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2004-10-15 1404928]
"IntelMeM"="c:\program files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-04 221184]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 53248]
"RealTray"="c:\program files\Real\RealPlayer\RealPlay.exe" [2006-01-10 26112]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2006-03-20 213936]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2006-03-20 86960]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]
"IPHSend"="c:\program files\Common Files\AOL\IPHSend\IPHSend.exe" [2006-02-17 124520]
"DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2006-09-14 157592]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2006-03-20 213936]
"McAfeeUpdaterUI"="c:\program files\McAfee\Common Framework\udaterui.exe" [2008-03-14 136512]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"IMEKRMIG6.1"="c:\windows\ime\imkr6_1\IMEKRMIG.EXE" [2004-08-04 44032]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-12-05 8523776]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2007-12-05 1626112]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\soundman.exe [2007-04-16 577536]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ALUAlert"="c:\program files\Symantec\LiveUpdate\ALUNotify.exe" [2006-05-15 67264]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Kodak EasyShare software.lnk - c:\program files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2004-7-23 757760]
Kodak software updater.lnk - c:\program files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe [2004-2-13 16423]
MA111 Configuration Utility.lnk - c:\program files\NETGEAR\MA111 Configuration Utility\wlancfg.exe [2007-4-7 459264]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
WG111v2 Smart Wizard Wireless Setting.lnk - c:\program files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe [2007-4-7 745472]

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32
"wave"= serwvdrv.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]
@="FSFilter Activity Monitor"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Common Files\\AOL\\1137106906\\ee\\aolsoftware.exe"=
"c:\\Program Files\\Common Files\\AOL\\1137106906\\ee\\aim6.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\SAGENT4.EXE"=
"c:\\Program Files\\Steam\\SteamApps\\grungerockr\\counter-strike source\\hl2.exe"=
"c:\\Soldat\\Soldat.exe"=
"c:\\Program Files\\Steam\\SteamApps\\grungerockr\\half-life 2\\hl2.exe"=
"c:\\StubInstaller.exe"=
"c:\\Program Files\\Steam\\steam.exe"=
"c:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Civilization4.exe"=
"c:\\Program Files\\Steam\\SteamApps\\grungerockr\\team fortress 2\\hl2.exe"=
"c:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Warlords\\Civ4Warlords.exe"=
"c:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Warlords\\Civ4Warlords_PitBoss.exe"=
"c:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Beyond the Sword\\Civ4BeyondSword.exe"=
"c:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Beyond the Sword\\Civ4BeyondSword_PitBoss.exe"=
"c:\\Program Files\\Rosetta Stone\\Rosetta Stone V3\\RosettaStoneVersion3.exe"=
"c:\\Program Files\\Rosetta Stone\\Rosetta Stone V3\\support\\bin\\win\\RosettaStoneLtdServices.exe"=
"c:\\Program Files\\McAfee\\Common Framework\\FrameworkService.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"12651:TCP"= 12651:TCP:BitComet 12651 TCP
"12651:UDP"= 12651:UDP:BitComet 12651 UDP
"3724:TCP"= 3724:TCP:Blizzard Downloader
"6112:TCP"= 6112:TCP:Blizzard Downloader
"6881:TCP"= 6881:TCP:Blizzard Downloader
"<NO NAME>"=
"12301:TCP"= 12301:TCP:160.36.178.188/255.255.255.255:Enabled:McAfeeServer
"12301:UDP"= 12301:UDP:160.36.178.188/255.255.255.255:Enabled:McAfeeServer
"12302:TCP"= 12302:TCP:160.36.178.188/255.255.255.255:Enabled:McAfeeUpdate
"12302:UDP"= 12302:UDP:160.36.178.188/255.255.255.255:Enabled:McAfeeUpdate

R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360\0300000.087\SymEFA.sys [5/15/2009 2:14 PM 310320]
R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\N360\0300000.087\BHDrvx86.sys [5/15/2009 2:14 PM 258608]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\N360\0300000.087\cchpx86.sys [5/15/2009 2:14 PM 482352]
R1 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090513.001\IDSXpx86.sys [5/19/2009 2:01 PM 276344]
R2 EAPPkt;Realtek EAPPkt Protocol;c:\windows\system32\drivers\EAPPkt.sys [1/11/2006 10:26 PM 66048]
R2 N360;Norton 360;c:\program files\Norton 360\Engine\3.0.0.135\ccSvcHst.exe [5/15/2009 2:14 PM 115560]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [3/23/2008 7:20 PM 24652]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\eengine\EraserUtilRebootDrv.sys [5/15/2009 2:23 PM 101936]
R3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;c:\windows\system32\drivers\wg111v2.sys [4/7/2007 10:37 PM 272128]
S3 cpuz132;cpuz132;c:\windows\system32\drivers\cpuz132_x32.sys [4/28/2009 10:48 PM 12672]
S3 SjyPkt;SjyPkt;c:\windows\system32\drivers\SjyPkt.sys [4/7/2007 10:37 PM 13532]
.
Contents of the 'Scheduled Tasks' folder

2009-05-22 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]

2009-05-22 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-03-04 16:13]
.
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office10\EXCEL.EXE/3000
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
FF - ProfilePath - c:\documents and settings\Taylor\Application Data\Mozilla\Firefox\Profiles\larpsyty.default\
FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=tb50fftrie7&query=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.google.com
FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=tb50fftrab&query=
FF - component: c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\components\coFFPlgn.dll
FF - component: c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\IPSFFPlgn\components\IPSFFPl.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - plugin: c:\documents and settings\Taylor\Application Data\Mozilla\Firefox\Profiles\larpsyty.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071303000006.dll
FF - plugin: c:\program files\GameTap\bin\Release\npgametaptool.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npqtplugin8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\QuickTime\Plugins\npqtplugin8.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-22 11:04
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\N360]
"ImagePath"="\"c:\program files\Norton 360\Engine\3.0.0.135\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files\Norton 360\Engine\3.0.0.135\diMaster.dll\" /prefetch:1"
.
Completion time: 2009-05-22 11:13
ComboFix-quarantined-files.txt 2009-05-22 16:12

Pre-Run: 5,684,465,664 bytes free
Post-Run: 12,123,512,832 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

Current=2 Default=2 Failed=1 LastKnownGood=4 Sets=1,2,3,4
299 --- E O F --- 2009-05-13 13:41

#10 SifuMike

SifuMike

    malware expert


  • Members
  • 15,385 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Vancouver (not BC) WA (Not DC) USA
  • Local time:12:19 AM

Posted 22 May 2009 - 12:04 PM

Hi floydhead73,

Looks good. :thumbup2: Now we look for stragglers.

Please disable any running anti-virus program before running Kaspersky Online Scanner.
If you are unsure how to do this, see this topic: http://www.bleepingcomputer.com/forums/t/114351/how-to-temporarily-disable-your-anti-virus-firewall-and-anti-malware-programs/
Close any open browsers

Please do a scan with Kaspersky Online Scanner

You can refer to this animation by sundavis.


Note: If you are using Windows Vista, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.

Click on the Accept button and install any components it needs.
  • The program will install and then begin downloading the latest definition files.
  • After the files have been downloaded on the left side of the page in the Scan section select My Computer.
  • This will start the program and scan your system.
  • The scan will take a while, so be patient and let it run.
  • Once the scan is complete, click on View scan report
  • Now, click on the Save Report as button.
  • In the drop down box labeled Files of type change the type to Text file.
  • Save the file to your desktop.
  • Copy and paste that information in your next post.
This scanner will only scan. It does not remove any malware it finds.
If I've saved you time & money,
please make a donation so I can keep helping people just like you! You can donate using a credit card and PayPal. Thank you!



Posted Image

Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#11 floydhead73

floydhead73
  • Topic Starter

  • Members
  • 51 posts
  • OFFLINE
  •  
  • Local time:02:19 AM

Posted 22 May 2009 - 01:11 PM

It wouldn't update. Something to do with a logic error in the download process. Anti-virus is disabled. Even firewall is down.

#12 SifuMike

SifuMike

    malware expert


  • Members
  • 15,385 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Vancouver (not BC) WA (Not DC) USA
  • Local time:12:19 AM

Posted 22 May 2009 - 02:20 PM

Hi,

We will use a different scanner.

Please go to the following link ESET Online Scanner Link
Tick the box YES, I accept the Terms Of Use
Click the Start button
Now click the Install button
Click Start

The scanner engine will initialise and update

Do Not tick the box Remove found threats
Click the Scan button

The scan will now run, please be patient

When the scan finishes click the Details tab
Copy and paste the contents of the C:\Program Files\EsetOnlineScanner\log.txt back here.
If I've saved you time & money,
please make a donation so I can keep helping people just like you! You can donate using a credit card and PayPal. Thank you!



Posted Image

Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#13 floydhead73

floydhead73
  • Topic Starter

  • Members
  • 51 posts
  • OFFLINE
  •  
  • Local time:02:19 AM

Posted 22 May 2009 - 03:29 PM

Oh my goodness. Failed to connect. Sorry.

#14 SifuMike

SifuMike

    malware expert


  • Members
  • 15,385 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Vancouver (not BC) WA (Not DC) USA
  • Local time:12:19 AM

Posted 22 May 2009 - 04:00 PM

That's OK . :thumbup2:
If I've saved you time & money,
please make a donation so I can keep helping people just like you! You can donate using a credit card and PayPal. Thank you!



Posted Image

Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#15 floydhead73

floydhead73
  • Topic Starter

  • Members
  • 51 posts
  • OFFLINE
  •  
  • Local time:02:19 AM

Posted 22 May 2009 - 05:06 PM

:thumbup2: Thanks for all your help!




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users