BTW, I'd like to donate. After the 1st, I'm on SS and broke at the moment. I saw a paypal donation for combo fix, will that work?
combo fix log:
ComboFix 10-06-21.01 - Owner 06/21/2010 17:36:19.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.502.256 [GMT -7:00]
Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe
AV: Norton Internet Security *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
AV: Spyware Doctor with AntiVirus *On-access scanning disabled* (Updated) {D3C23B96-C9DC-477F-8EF1-69AF17A6EFF6}
FW: Norton Internet Security *disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\All Users\Start Menu\HP Image Zone .lnk
c:\documents and settings\All Users\Start Menu\Programs\PC Doc Pro v5
c:\documents and settings\All Users\Start Menu\Programs\PC Doc Pro v5\PC Doc Pro v5.lnk
c:\documents and settings\All Users\Start Menu\Programs\PC Doc Pro v5\Uninstall PC Doc Pro v5.lnk
c:\documents and settings\Owner\Desktop\PC Doc Pro v5.lnk
c:\documents and settings\Owner\Recent\homepage.url
c:\program files\PC Doc Pro v5
c:\program files\PC Doc Pro v5\Backups\40253.3688711574
c:\program files\PC Doc Pro v5\Backups\40253.3690359144
c:\program files\PC Doc Pro v5\Backups\40254.3773086574
c:\program files\PC Doc Pro v5\Backups\40254.3774068519
c:\program files\PC Doc Pro v5\Backups\40255.4365615857
c:\program files\PC Doc Pro v5\Backups\40256.3504345602
c:\program files\PC Doc Pro v5\Backups\40256.5144590857
c:\program files\PC Doc Pro v5\Backups\40256.5145153356
c:\program files\PC Doc Pro v5\Backups\40257.7486152662
c:\program files\PC Doc Pro v5\Backups\40258.3803150231
c:\program files\PC Doc Pro v5\Backups\40259.374752419
c:\program files\PC Doc Pro v5\Backups\40260.7636438426
c:\program files\PC Doc Pro v5\Backups\40261.3496609144
c:\program files\PC Doc Pro v5\Backups\40262.4070466204
c:\program files\PC Doc Pro v5\Backups\40262.4072912963
c:\program files\PC Doc Pro v5\Backups\40263.3047929282
c:\program files\PC Doc Pro v5\Backups\40263.304816794
c:\program files\PC Doc Pro v5\Backups\40264.7238410648
c:\program files\PC Doc Pro v5\Backups\40265.3109330787
c:\program files\PC Doc Pro v5\Backups\40265.3109634607
c:\program files\PC Doc Pro v5\Backups\40265.6399909722
c:\program files\PC Doc Pro v5\Backups\40265.6400262384
c:\program files\PC Doc Pro v5\Backups\40266.3861617593
c:\program files\PC Doc Pro v5\Backups\40267.5251166551
c:\program files\PC Doc Pro v5\Backups\40267.5254718287
c:\program files\PC Doc Pro v5\Backups\40267.5323524421
c:\program files\PC Doc Pro v5\Backups\40269.3318679977
c:\program files\PC Doc Pro v5\Backups\40269.3319184607
c:\program files\PC Doc Pro v5\Backups\40270.355372419
c:\program files\PC Doc Pro v5\Backups\40271.3185655903
c:\program files\PC Doc Pro v5\Backups\40272.2853993634
c:\program files\PC Doc Pro v5\Backups\40272.2854205208
c:\program files\PC Doc Pro v5\Backups\40273.3718117593
c:\program files\PC Doc Pro v5\Backups\40274.3070574537
c:\program files\PC Doc Pro v5\Backups\40274.3070889236
c:\program files\PC Doc Pro v5\Backups\40275.7145019444
c:\program files\PC Doc Pro v5\Backups\40276.3517925231
c:\program files\PC Doc Pro v5\Backups\40277.7151012616
c:\program files\PC Doc Pro v5\Backups\40278.8837559491
c:\program files\PC Doc Pro v5\Backups\40279.5782358449
c:\program files\PC Doc Pro v5\Backups\40280.7048255903
c:\program files\PC Doc Pro v5\Backups\40281.3317088889
c:\program files\PC Doc Pro v5\Backups\40283.6587398727
c:\program files\PC Doc Pro v5\Backups\40283.6587854398
c:\program files\PC Doc Pro v5\Backups\40284.7454300463
c:\program files\PC Doc Pro v5\Backups\40285.2940078819
c:\program files\PC Doc Pro v5\Backups\40286.3889724306
c:\program files\PC Doc Pro v5\Backups\40287.3650443056
c:\program files\PC Doc Pro v5\Backups\40287.3650696181
c:\program files\PC Doc Pro v5\Backups\40287.3746665162
c:\program files\PC Doc Pro v5\Backups\40288.2606230093
c:\program files\PC Doc Pro v5\Backups\40288.2607262731
c:\program files\PC Doc Pro v5\Backups\40289.4798576736
c:\program files\PC Doc Pro v5\Backups\40289.4798775694
c:\program files\PC Doc Pro v5\Backups\40291.4787541551
c:\program files\PC Doc Pro v5\Backups\40291.4787993634
c:\program files\PC Doc Pro v5\Backups\40292.394828912
c:\program files\PC Doc Pro v5\Backups\40292.3948479051
c:\program files\PC Doc Pro v5\Backups\40293.3099755787
c:\program files\PC Doc Pro v5\Backups\40293.3100128356
c:\program files\PC Doc Pro v5\Backups\40294.3647661574
c:\program files\PC Doc Pro v5\Backups\40295.288869537
c:\program files\PC Doc Pro v5\Backups\40295.2888995486
c:\program files\PC Doc Pro v5\Backups\40296.5085470718
c:\program files\PC Doc Pro v5\Backups\40297.4085143403
c:\program files\PC Doc Pro v5\Backups\40298.2944078935
c:\program files\PC Doc Pro v5\Backups\40299.3037073032
c:\program files\PC Doc Pro v5\Backups\40300.401761412
c:\program files\PC Doc Pro v5\Backups\40301.2780407176
c:\program files\PC Doc Pro v5\Backups\40301.2780683796
c:\program files\PC Doc Pro v5\Backups\40302.2743286806
c:\program files\PC Doc Pro v5\Backups\40302.2744075347
c:\program files\PC Doc Pro v5\Backups\40302.2745782523
c:\program files\PC Doc Pro v5\Backups\40302.2745892824
c:\program files\PC Doc Pro v5\Backups\40303.3007007523
c:\program files\PC Doc Pro v5\Backups\40303.3007557292
c:\program files\PC Doc Pro v5\Backups\40304.2436358681
c:\program files\PC Doc Pro v5\Backups\40304.244154537
c:\program files\PC Doc Pro v5\Backups\40305.2932732755
c:\program files\PC Doc Pro v5\Backups\40308.2920792593
c:\program files\PC Doc Pro v5\Backups\40308.2924432407
c:\program files\PC Doc Pro v5\Backups\40308.2938463889
c:\program files\PC Doc Pro v5\Backups\40309.3411309838
c:\program files\PC Doc Pro v5\Backups\40310.6169454398
c:\program files\PC Doc Pro v5\Backups\40310.6169926505
c:\program files\PC Doc Pro v5\Backups\40311.3928460532
c:\program files\PC Doc Pro v5\Backups\40311.6339426968
c:\program files\PC Doc Pro v5\Backups\40312.6096687847
c:\program files\PC Doc Pro v5\Backups\40313.6803435185
c:\program files\PC Doc Pro v5\Backups\40314.2398190625
c:\program files\PC Doc Pro v5\Backups\40314.2585304514
c:\program files\PC Doc Pro v5\Backups\40314.2585966435
c:\program files\PC Doc Pro v5\Backups\40315.2802618634
c:\program files\PC Doc Pro v5\Backups\40315.3046128009
c:\program files\PC Doc Pro v5\Backups\40316.7454817708
c:\program files\PC Doc Pro v5\Backups\40316.7458859491
c:\program files\PC Doc Pro v5\Backups\40318.3578627662
c:\program files\PC Doc Pro v5\Backups\40318.3656568287
c:\program files\PC Doc Pro v5\Backups\40319.781742338
c:\program files\PC Doc Pro v5\Backups\40319.7817862847
c:\program files\PC Doc Pro v5\Backups\40320.4698819907
c:\program files\PC Doc Pro v5\Backups\40321.4693817708
c:\program files\PC Doc Pro v5\Backups\40322.2595107176
c:\program files\PC Doc Pro v5\Backups\40322.2598487153
c:\program files\PC Doc Pro v5\Backups\40322.4388646528
c:\program files\PC Doc Pro v5\Backups\40322.4388971991
c:\program files\PC Doc Pro v5\Backups\40323.356753287
c:\program files\PC Doc Pro v5\Backups\40323.3568476852
c:\program files\PC Doc Pro v5\Backups\40324.5855937037
c:\program files\PC Doc Pro v5\Backups\40324.585659537
c:\program files\PC Doc Pro v5\Backups\40324.5941655787
c:\program files\PC Doc Pro v5\Backups\40326.5787845486
c:\program files\PC Doc Pro v5\Backups\40326.5788617593
c:\program files\PC Doc Pro v5\Backups\40327.6806121528
c:\program files\PC Doc Pro v5\Backups\40327.6806589931
c:\program files\PC Doc Pro v5\Backups\40329.3504812269
c:\program files\PC Doc Pro v5\Backups\40329.3506163194
c:\program files\PC Doc Pro v5\Backups\40329.3593381019
c:\program files\PC Doc Pro v5\Backups\40330.2737346181
c:\program files\PC Doc Pro v5\Backups\40330.2737735069
c:\program files\PC Doc Pro v5\Backups\40331.8413301042
c:\program files\PC Doc Pro v5\Backups\40332.2839865394
c:\program files\PC Doc Pro v5\Backups\40332.2840668403
c:\program files\PC Doc Pro v5\Backups\40333.2967429745
c:\program files\PC Doc Pro v5\Backups\40333.2968883796
c:\program files\PC Doc Pro v5\Backups\40334.6283004167
c:\program files\PC Doc Pro v5\Backups\40334.6283465278
c:\program files\PC Doc Pro v5\Backups\40335.3201540741
c:\program files\PC Doc Pro v5\Backups\40335.3202056134
c:\program files\PC Doc Pro v5\Backups\40336.718666088
c:\program files\PC Doc Pro v5\Backups\40336.7186984491
c:\program files\PC Doc Pro v5\Backups\40337.3136859722
c:\program files\PC Doc Pro v5\Backups\40337.313713287
c:\program files\PC Doc Pro v5\Backups\40340.5768397338
c:\program files\PC Doc Pro v5\Backups\40340.5768701157
c:\program files\PC Doc Pro v5\Backups\40341.4897213079
c:\program files\PC Doc Pro v5\Backups\40341.489752419
c:\program files\PC Doc Pro v5\Backups\40342.2746652546
c:\program files\PC Doc Pro v5\Backups\40342.2747084722
c:\program files\PC Doc Pro v5\Backups\40343.2588633796
c:\program files\PC Doc Pro v5\Backups\40343.2589263194
c:\program files\PC Doc Pro v5\Backups\40344.321614213
c:\program files\PC Doc Pro v5\Backups\40344.3216563542
c:\program files\PC Doc Pro v5\Backups\40345.4768296065
c:\program files\PC Doc Pro v5\Backups\40345.4769162268
c:\program files\PC Doc Pro v5\Backups\40346.3020699421
c:\program files\PC Doc Pro v5\Backups\40346.3021023148
c:\program files\PC Doc Pro v5\Backups\40347.2793305093
c:\program files\PC Doc Pro v5\Backups\40347.2793925347
c:\program files\PC Doc Pro v5\Backups\40348.4432599074
c:\program files\PC Doc Pro v5\Backups\40348.4432935417
c:\program files\PC Doc Pro v5\Backups\40348.7988234143
c:\program files\PC Doc Pro v5\Backups\40348.7988774884
c:\program files\PC Doc Pro v5\Backups\40349.4487631944
c:\program files\PC Doc Pro v5\Backups\40349.4488492824
c:\program files\PC Doc Pro v5\Backups\40350.3799871528
c:\program files\PC Doc Pro v5\Backups\40350.3800294676
c:\program files\PC Doc Pro v5\Eraser.exe
c:\program files\PC Doc Pro v5\eWebClient.dll
c:\program files\PC Doc Pro v5\eWebControl365.dll
c:\program files\PC Doc Pro v5\IgnoredKeys.ini
c:\program files\PC Doc Pro v5\IgnoredValues.ini
c:\program files\PC Doc Pro v5\Log.txt
c:\program files\PC Doc Pro v5\PC Doc Pro Cleanup.exe
c:\program files\PC Doc Pro v5\PC Doc Pro Scheduler.exe
c:\program files\PC Doc Pro v5\PC Doc Pro Uninstaller.exe
c:\program files\PC Doc Pro v5\PC Doc Pro.bin
c:\program files\PC Doc Pro v5\PC Doc Pro.dat
c:\program files\PC Doc Pro v5\PC Doc Pro.exe
c:\program files\PC Doc Pro v5\PC Doc Pro.ini
c:\program files\PC Doc Pro v5\unins000.dat
c:\program files\PC Doc Pro v5\unins000.exe
c:\program files\PC Doc Pro v5\Update.exe
c:\program files\PC Doc Pro v5\Version.dat
C:\s
c:\windows\system32\drivers\dfg.sys
Infected copy of c:\windows\system32\drivers\cdrom.sys was found and disinfected
Restored copy from - Kitty had a snack
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_ZWANGISRCH_SERVICE
-------\Service_dfg
((((((((((((((((((((((((( Files Created from 2010-05-22 to 2010-06-22 )))))))))))))))))))))))))))))))
.
2010-06-18 22:08 . 2010-06-21 22:16 63488 ----a-w- c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10006.dll
2010-06-18 22:08 . 2010-06-18 22:08 52224 ----a-w- c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-06-18 22:08 . 2010-06-21 22:15 117760 ----a-w- c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-06-18 22:07 . 2010-06-18 22:07 -------- d-----w- c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com
2010-06-18 22:07 . 2010-06-18 22:07 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2010-06-18 22:07 . 2010-06-18 22:07 -------- d-----w- c:\program files\SUPERAntiSpyware
2010-06-14 16:19 . 2010-06-14 16:19 388096 ----a-r- c:\documents and settings\Owner\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-06-14 16:19 . 2010-06-14 16:19 -------- d-----w- c:\program files\Trend Micro
2010-06-14 15:55 . 2010-06-14 15:55 -------- d-----w- c:\windows\Internet Logs
2010-06-10 16:25 . 2010-06-21 20:56 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-06-10 16:25 . 2010-06-10 16:25 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple Computer
2010-06-03 16:39 . 2010-06-03 16:39 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Identities
2010-05-31 01:12 . 2010-05-31 01:12 -------- d-----w- c:\documents and settings\Owner\Application Data\Malwarebytes
2010-05-31 01:11 . 2010-04-29 22:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-05-31 01:11 . 2010-05-31 01:11 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-05-31 01:11 . 2010-04-29 22:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-05-31 01:11 . 2010-05-31 01:12 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-05-30 02:34 . 2010-05-06 04:01 361904 ----a-w- c:\windows\system32\drivers\symtdi.sys
2010-05-30 02:34 . 2010-04-22 03:02 173104 ----a-w- c:\windows\system32\drivers\symefa.sys
2010-05-30 02:34 . 2010-04-22 02:29 43696 ----a-w- c:\windows\system32\drivers\srtspx.sys
2010-05-30 02:34 . 2010-02-04 01:40 328752 ----a-r- c:\windows\system32\drivers\symds.sys
2010-05-30 02:34 . 2010-04-29 05:03 116784 ----a-w- c:\windows\system32\drivers\ironx86.sys
2010-05-30 02:33 . 2010-02-26 00:22 501888 ----a-w- c:\windows\system32\drivers\cchpx86.sys
2010-05-29 23:54 . 2010-05-29 23:54 -------- d-----w- c:\documents and settings\Owner\Application Data\CheckPoint
2010-05-29 23:44 . 2010-06-14 15:54 -------- d-----w- c:\documents and settings\Owner\Local Settings\Application Data\Conduit
2010-05-29 23:42 . 2010-05-29 23:42 -------- d-----w- c:\program files\CheckPoint
2010-05-29 23:42 . 2010-05-29 23:42 4212 ---ha-w- c:\windows\system32\zllictbl.dat
2010-05-29 23:40 . 2010-05-26 20:03 112128 ----a-w- C:\vsdata.dll
2010-05-29 23:40 . 2010-05-13 17:02 532224 ----a-w- C:\vsdatant.sys
2010-05-29 19:54 . 2010-05-29 19:54 60808 ----a-w- c:\windows\system32\S32EVNT1.DLL
2010-05-29 19:54 . 2010-05-29 19:54 124976 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2010-05-29 19:54 . 2010-05-29 20:08 -------- d-----w- c:\program files\Common Files\Symantec Shared
2010-05-29 19:54 . 2010-05-29 19:54 -------- d-----w- c:\program files\Symantec
2010-05-29 19:52 . 2010-05-30 03:14 -------- d-----w- c:\windows\system32\drivers\NIS
2010-05-29 19:52 . 2010-05-29 19:52 -------- d-----w- c:\program files\Norton Internet Security
2010-05-29 19:52 . 2010-05-29 19:52 -------- d-----w- c:\program files\Windows Sidebar
2010-05-29 19:52 . 2010-05-29 19:52 -------- d-----w- c:\program files\NortonInstaller
2010-05-29 19:52 . 2010-05-29 19:52 -------- d-----w- c:\documents and settings\All Users\Application Data\NortonInstaller
2010-05-29 19:39 . 2010-05-29 20:01 -------- d-----w- c:\documents and settings\All Users\Application Data\Norton
2010-05-26 00:53 . 2010-05-26 00:53 503808 ----a-w- c:\documents and settings\Owner\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-2382f651-n\msvcp71.dll
2010-05-26 00:53 . 2010-05-26 00:53 499712 ----a-w- c:\documents and settings\Owner\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-2382f651-n\jmc.dll
2010-05-26 00:53 . 2010-05-26 00:53 348160 ----a-w- c:\documents and settings\Owner\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-2382f651-n\msvcr71.dll
2010-05-26 00:53 . 2010-05-26 00:53 61440 ----a-w- c:\documents and settings\Owner\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-1a02bce9-n\decora-sse.dll
2010-05-26 00:53 . 2010-05-26 00:53 12800 ----a-w- c:\documents and settings\Owner\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-1a02bce9-n\decora-d3d.dll
2010-05-26 00:52 . 2010-04-13 00:29 411368 ----a-w- c:\windows\system32\deployJava1.dll
2010-05-25 22:13 . 2010-05-25 22:15 -------- d-----w- c:\documents and settings\Owner\Local Settings\Application Data\yqhnhvshb
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-22 00:50 . 2009-12-12 20:02 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-06-21 23:54 . 2008-12-09 01:58 1 ----a-w- c:\documents and settings\Owner\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-06-21 22:25 . 2010-03-16 15:54 105 ----a-w- c:\windows\IntIgn0xF28456.dat
2010-06-15 14:28 . 2010-03-19 18:33 -------- d-----w- c:\program files\Spyware Doctor
2010-06-08 02:16 . 2010-03-19 18:43 763832 ----a-w- c:\windows\BDTSupport.dll
2010-06-08 00:21 . 2010-03-19 18:43 1652664 ----a-w- c:\windows\PCTBDCore.dll
2010-05-30 00:37 . 2009-12-14 19:55 -------- d-----w- c:\documents and settings\Owner\Application Data\Registry Mechanic
2010-05-29 19:54 . 2010-05-29 19:54 805 ----a-w- c:\windows\system32\drivers\SYMEVENT.INF
2010-05-29 19:54 . 2010-05-29 19:54 7443 ----a-w- c:\windows\system32\drivers\SYMEVENT.CAT
2010-05-26 01:04 . 2008-09-22 00:14 21984 ----a-w- c:\documents and settings\Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-05-26 00:52 . 2008-12-07 19:58 -------- d-----w- c:\program files\java
2010-05-12 02:28 . 2010-03-19 18:33 63360 ----a-w- c:\windows\system32\drivers\pctplsg.sys
2010-05-12 02:28 . 2010-03-19 18:33 218592 ----a-w- c:\windows\system32\drivers\PCTCore.sys
2010-05-05 00:28 . 2008-12-07 19:58 -------- d-----w- c:\program files\Common Files\Java
2010-05-05 00:28 . 2010-05-05 00:28 503808 ----a-w- c:\documents and settings\Owner\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-2d9b1071-n\msvcp71.dll
2010-05-05 00:28 . 2010-05-05 00:28 499712 ----a-w- c:\documents and settings\Owner\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-2d9b1071-n\jmc.dll
2010-05-05 00:28 . 2010-05-05 00:28 348160 ----a-w- c:\documents and settings\Owner\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-2d9b1071-n\msvcr71.dll
2010-05-05 00:28 . 2010-05-05 00:28 61440 ----a-w- c:\documents and settings\Owner\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-4249b494-n\decora-sse.dll
2010-05-05 00:28 . 2010-05-05 00:28 12800 ----a-w- c:\documents and settings\Owner\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-4249b494-n\decora-d3d.dll
2010-04-19 16:13 . 2010-04-19 16:13 86016 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\arh.exe
2008-09-30 17:06 . 2008-09-30 17:06 128535711 ----a-w- c:\program files\openofficeorg1.cab
2002-03-11 09:06 . 2002-03-11 09:06 1822520 ----a-w- c:\program files\instmsiw.exe
2002-03-11 08:45 . 2002-03-11 08:45 1708856 ----a-w- c:\program files\instmsia.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2008-11-06 4347120]
"OM2_Monitor"="c:\program files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" [2009-11-26 95632]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2010-06-07 2403568]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"OM2_Monitor"="c:\program files\OLYMPUS\OLYMPUS Master 2\FirstStart.exe" [2009-11-26 54672]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-11-11 417792]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [3/19/2010 11:33 AM 218592]
R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NIS\1107000.00C\symds.sys [5/29/2010 7:34 PM 328752]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NIS\1107000.00C\symefa.sys [5/29/2010 7:34 PM 173104]
R0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys [3/19/2010 11:47 AM 51984]
R0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys [3/19/2010 11:47 AM 59664]
R1 BHDrvx86;BHDrvx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.6.0.32\Definitions\BASHDefs\20100522.001\BHDrvx86.sys [5/22/2010 11:16 AM 691248]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NIS\1107000.00C\cchpx86.sys [5/29/2010 7:33 PM 501888]
R1 pctgntdi;pctgntdi;c:\windows\system32\drivers\pctgntdi.sys [3/19/2010 11:33 AM 233136]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 11:25 AM 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/10/2010 11:41 AM 67656]
R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NIS\1107000.00C\ironx86.sys [5/29/2010 7:34 PM 116784]
R2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\Spyware Doctor\BDT\BDTUpdateService.exe [3/19/2010 11:43 AM 112592]
R2 NIS;Norton Internet Security;c:\program files\Norton Internet Security\Engine\17.7.0.12\ccsvchst.exe [5/29/2010 7:32 PM 126392]
R2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files\Common Files\PC Tools\sMonitor\StartManSvc.exe [12/15/2009 7:54 PM 632792]
R3 A3AB;D-Link AirPro 802.11a/b Wireless Adapter Service(A3AB);c:\windows\system32\drivers\A3AB.sys [5/23/2007 5:15 AM 547744]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [5/29/2010 12:56 PM 102448]
R3 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.6.0.32\Definitions\IPSDefs\20100617.005\IDSXpx86.sys [6/18/2010 5:46 PM 331640]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [3/24/2010 5:02 PM 136176]
S3 ICDUSB2;Sony IC Recorder (ST);c:\windows\system32\drivers\ICDUSB2.sys [11/28/2002 10:23 PM 39048]
S3 pctplsg;pctplsg;c:\windows\system32\drivers\pctplsg.sys [3/19/2010 11:33 AM 63360]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [3/19/2010 11:33 AM 366840]
S3 TfNetMon;TfNetMon;c:\windows\system32\drivers\TfNetMon.sys [3/19/2010 11:47 AM 33552]
S3 ThreatFire;ThreatFire;c:\program files\Spyware Doctor\TFEngine\TFService.exe service --> c:\program files\Spyware Doctor\TFEngine\TFService.exe service [?]
.
Contents of the 'Scheduled Tasks' folder
2010-06-22 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-25 00:02]
2010-06-22 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-25 00:02]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
LSP: c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll
.
- - - - ORPHANS REMOVED - - - -
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file)
WebBrowser-{D0523BB4-21E7-11DD-9AB7-415B56D89593} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
HKCU-Run-PC Doc Pro Scheduler - c:\program files\PC Doc Pro v5\PC Doc Pro Scheduler.exe
AddRemove-PC Doc Pro - c:\program files\PC Doc Pro v5\unins000.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2010-06-21 17:52
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NIS]
"ImagePath"="\"c:\program files\Norton Internet Security\Engine\17.7.0.12\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files\Norton Internet Security\Engine\17.7.0.12\diMaster.dll\" /prefetch:1"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(720)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
- - - - - - - > 'lsass.exe'(776)
c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll
- - - - - - - > 'explorer.exe'(4044)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\HPZipm12.exe
c:\program files\Yahoo!\Messenger\ymsgr_tray.exe
.
**************************************************************************
.
Completion time: 2010-06-21 17:59:52 - machine was rebooted
ComboFix-quarantined-files.txt 2010-06-22 00:59
Pre-Run: 118,967,599,104 bytes free
Post-Run: 120,238,493,696 bytes free
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
- - End Of File - - B912604502DB68BA17792D650348811D