Thanks for getting back to me. I just ran ComboFix and Hijackthis. The logs are attached.
ComboFix 07-12-10.2 - Administrator 2007-12-10 9:31:28.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2599 [GMT -5:00]
Running from: C:\Documents and Settings\Administrator\Desktop\ComboFix.exe
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Administrator\Favorites\Online Security Guide.lnk
C:\Documents and Settings\All Users\Start Menu\Live Safety Center.lnk
C:\Documents and Settings\LocalService\Application Data\NetMon
C:\Documents and Settings\LocalService\Application Data\NetMon\domains.txt
C:\Documents and Settings\LocalService\Application Data\NetMon\log.txt
C:\Program Files\Messenger\rtemem.html
C:\Program Files\Temporary
C:\Temp\1cb
C:\Temp\1cb\syscheck.log
C:\Temp\abW9
C:\Temp\abW9\tPho.log
C:\WINDOWS\IA
C:\WINDOWS\IA\\KE.vbs
C:\WINDOWS\IA\KE.vbs
C:\WINDOWS\system32\_suspicious_files\ijjlm.ini
C:\WINDOWS\system32\_suspicious_files\ijjlm.ini2
C:\WINDOWS\system32\decysktp.dll
C:\WINDOWS\system32\f1
C:\WINDOWS\system32\gxqejttr.dll
C:\WINDOWS\system32\h2
C:\WINDOWS\system32\ijjlm.ini
C:\WINDOWS\system32\ijjlm.ini2
C:\WINDOWS\system32\kurnvwvv.dll
C:\WINDOWS\system32\lxhkqjtw.dll
C:\WINDOWS\system32\m1
C:\WINDOWS\system32\media
C:\WINDOWS\system32\media\AvidRender.wav
C:\WINDOWS\system32\mljji.dll
C:\WINDOWS\system32\mrqkwpfv.ini
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\system32\r2
C:\WINDOWS\system32\rMa01yy
C:\WINDOWS\system32\rMa02yy
C:\WINDOWS\system32\sppugjyx.dll
C:\WINDOWS\system32\tdhoptxn.dll
C:\WINDOWS\system32\vfpwkqrm.dll
C:\WINDOWS\system32\xpjvvppx.ini
C:\WINDOWS\system32\xppvvjpx.dll
C:\WINDOWS\system32\xyjgupps.ini
C:\WINDOWS\uninstall_nmon.vbs
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\LEGACY_CMDSERVICE
-------\LEGACY_DOMAINSERVICE
-------\LEGACY_NETWORK_MONITOR
-------\cmdService
((((((((((((((((((((((((( Files Created from 2007-11-10 to 2007-12-10 )))))))))))))))))))))))))))))))
.
2007-12-04 14:33 . 2007-12-04 14:33 <DIR> d-------- C:\Program Files\GiPo@Utilities
2007-12-04 14:33 . 2007-12-04 14:33 <DIR> d-------- C:\Program Files\Common Files\Gibinsoft Shared
2007-12-04 12:32 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2007-12-04 12:28 . 2007-12-04 12:28 <DIR> d-------- C:\Documents and Settings\Administrator\.java
2007-12-04 12:15 . 2007-12-10 09:36 <DIR> d-------- C:\WINDOWS\system32\_suspicious_files
2007-11-28 15:15 . 2007-11-28 15:15 90 --a------ C:\WINDOWS\system32\mcrh.tmp
2007-11-28 09:38 . 2007-12-06 11:50 <DIR> d-------- C:\OMFI MediaFiles
2007-11-27 16:51 . 2007-12-06 14:01 69 --a------ C:\WINDOWS\NeroDigital.ini
2007-11-21 09:10 . 2007-12-08 20:30 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2007-11-21 09:10 . 2007-11-21 09:10 1,409 --a------ C:\WINDOWS\QTFont.for
2007-11-20 09:11 . 2007-11-26 15:55 <DIR> d-------- C:\VundoFix Backups
2007-11-14 12:21 . 2007-12-04 12:35 10,676 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2007-11-14 12:21 . 2007-12-04 12:35 805 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.INF
2007-11-14 12:02 . 2007-11-14 12:24 <DIR> d-------- C:\WINDOWS\BDOSCAN8
2007-11-13 14:22 . 2007-11-13 14:53 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-11-13 12:43 . 2007-11-13 12:43 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Lavasoft
2007-11-13 12:42 . 2007-11-13 12:42 <DIR> d-------- C:\Program Files\Lavasoft
2007-11-13 09:00 . 2007-11-13 09:00 <DIR> d-------- C:\Program Files\MSXML 4.0
2007-11-12 14:59 . 2007-11-12 14:59 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Nero
2007-11-12 14:46 . 2007-11-12 14:46 <DIR> d-------- C:\Program Files\Nero
2007-11-12 14:46 . 2007-11-12 14:49 <DIR> d-------- C:\Program Files\Common Files\Nero
2007-11-12 14:46 . 2007-11-12 14:46 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Nero
2007-11-12 12:07 . 2007-07-20 09:18 <DIR> d-------- C:\WINDOWS\Microsoft.NET
2007-11-12 12:06 . 2007-11-12 12:06 <DIR> d-------- C:\WINDOWS\system32\s?mbols
2007-11-12 12:05 . 2005-09-22 12:35 <DIR> d---s---- C:\WINDOWS\Tasks
2007-11-12 12:04 . 2007-11-12 11:58 <DIR> d-------- C:\WINDOWS\?racle
2007-11-12 12:04 . 2007-11-12 12:04 <DIR> d-------- C:\Program Files\Common Files\A?pPatch
2007-11-12 12:03 . 2007-11-12 12:03 <DIR> d-------- C:\Program Files\Common Files\T?sks
2007-11-12 12:03 . 2007-11-12 12:03 <DIR> d-------- C:\Program Files\Common Files\T?sks
2007-11-12 12:02 . 2007-11-12 11:56 <DIR> d-------- C:\Program Files\F?nts
2007-11-12 12:02 . 2007-11-12 12:00 <DIR> d-------- C:\Program Files\s?stem
2007-11-12 12:01 . 2007-11-12 12:01 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\s?curity
2007-11-12 12:00 . 2007-11-12 12:00 <DIR> d-------- C:\WINDOWS\?ymantec
2007-11-12 12:00 . 2007-08-15 12:06 <DIR> d-------- C:\WINDOWS\AppPatch
2007-11-12 12:00 . 2007-11-12 12:00 <DIR> d-------- C:\Program Files\s?stem
2007-11-12 11:59 . 2007-11-12 11:59 <DIR> d-------- C:\WINDOWS\system32\M?crosoft.NET
2007-11-12 11:59 . 2004-11-09 23:24 <DIR> d---s---- C:\WINDOWS\system32\Microsoft
2007-11-12 11:59 . 2007-07-20 09:18 <DIR> d-------- C:\WINDOWS\Microsoft.NET
2007-11-12 11:59 . 2007-11-12 11:54 <DIR> d-------- C:\Program Files\ēasks
2007-11-12 11:59 . 2007-11-12 11:59 <DIR> d-------- C:\Program Files\Common Files\?ssembly
2007-11-12 11:59 . 2007-11-12 11:59 <DIR> d-------- C:\Program Files\a?sembly
2007-11-12 11:59 . 2007-11-12 11:59 <DIR> d-------- C:\Program Files\A?pPatch
2007-11-12 11:59 . 2007-11-12 11:58 <DIR> d-------- C:\Program Files\ąppPatch
2007-11-12 11:58 . 2007-11-12 11:58 <DIR> d-------- C:\WINDOWS\system32\a?sembly
2007-11-12 11:58 . 2007-11-12 11:58 <DIR> d-------- C:\WINDOWS\?racle
2007-11-12 11:58 . 2007-11-12 11:58 <DIR> d-------- C:\Program Files\ąppPatch
2007-11-12 11:58 . 2007-11-12 11:58 <DIR> d-------- C:\Program Files\ądobe
2007-11-12 11:58 . 2007-11-12 11:58 <DIR> d-------- C:\Program Files\s?mbols
2007-11-12 11:58 . 2007-11-12 11:53 <DIR> d-------- C:\Program Files\T?sks
2007-11-12 11:58 . 2005-09-22 13:18 <DIR> d-------- C:\Program Files\Microsoft.NET
2007-11-12 11:58 . 2007-11-12 11:55 <DIR> d-------- C:\Program Files\M?crosoft
2007-11-12 11:58 . 2007-11-12 11:58 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\s?mbols
2007-11-12 11:58 . 2006-10-12 07:50 <DIR> d---s---- C:\Documents and Settings\Administrator\Application Data\Microsoft
2007-11-12 11:57 . 2007-11-12 11:53 <DIR> d-------- C:\WINDOWS\ēasks
2007-11-12 11:57 . 2007-11-12 11:53 <DIR> d-------- C:\WINDOWS\ąppPatch
2007-11-12 11:57 . 2007-11-12 11:57 <DIR> d-------- C:\WINDOWS\system32\A?pPatch
2007-11-12 11:57 . 2007-11-12 11:56 <DIR> d-------- C:\WINDOWS\system32\?racle
2007-11-12 11:57 . 2007-07-20 09:18 <DIR> dr--s---- C:\WINDOWS\assembly
2007-11-12 11:57 . 2007-11-12 11:53 <DIR> d-------- C:\WINDOWS\?icrosoft
2007-11-12 11:57 . 2007-08-15 12:06 <DIR> d-------- C:\WINDOWS\AppPatch
2007-11-12 11:57 . 2007-11-12 11:55 <DIR> d-------- C:\WINDOWS\M?crosoft
2007-11-12 11:57 . 2007-11-12 11:55 <DIR> d-------- C:\Program Files\Common Files\ąppPatch
2007-11-12 11:57 . 2007-11-12 11:57 <DIR> d-------- C:\Program Files\Common Files\?ymantec
2007-11-12 11:57 . 2007-11-12 11:53 <DIR> d-------- C:\Program Files\Common Files\M?crosoft
2007-11-12 11:57 . 2007-11-12 12:01 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\s?curity
2007-11-12 11:56 . 2007-11-12 11:56 <DIR> d-------- C:\WINDOWS\system32\?racle
2007-11-12 11:56 . 2007-11-12 11:56 <DIR> d-------- C:\WINDOWS\system32\?icrosoft.NET
2007-11-12 11:56 . 2007-11-12 12:06 <DIR> d-------- C:\WINDOWS\system32\s?mbols
2007-11-12 11:56 . 2007-11-12 11:53 <DIR> d-------- C:\WINDOWS\system32\S?mantec
2007-11-12 11:56 . 2006-05-03 16:47 <DIR> d-------- C:\WINDOWS\security
2007-11-12 11:56 . 2007-07-20 09:18 <DIR> d-------- C:\WINDOWS\Microsoft.NET
2007-11-12 11:56 . 2007-11-12 11:53 <DIR> d-------- C:\WINDOWS\s?mbols
2007-11-12 11:56 . 2007-11-12 11:56 <DIR> d-------- C:\Program Files\s?stem32
2007-11-12 11:56 . 2007-11-12 11:56 <DIR> d-------- C:\Program Files\F?nts
2007-11-12 11:56 . 2007-11-12 11:55 <DIR> d-------- C:\Program Files\Common Files\?racle
2007-11-12 11:56 . 2007-11-12 11:53 <DIR> d-------- C:\Program Files\Common Files\?icrosoft.NET
2007-11-12 11:56 . 2007-11-12 11:56 <DIR> d-------- C:\Program Files\Common Files\?icrosoft
2007-11-12 11:56 . 2007-11-12 11:56 <DIR> d-------- C:\Program Files\Common Files\?ecurity
2007-11-12 11:56 . 2007-11-12 11:53 <DIR> d-------- C:\Program Files\Common Files\S?mantec
2007-11-12 11:56 . 2007-11-12 11:53 <DIR> d-------- C:\Program Files\Common Files\M?crosoft.NET
2007-11-12 11:56 . 2007-11-12 11:56 <DIR> d-------- C:\Program Files\?ecurity
2007-11-12 11:56 . 2007-11-12 11:56 <DIR> d-------- C:\Program Files\s?stem32
2007-11-12 11:56 . 2007-11-12 11:59 <DIR> d-------- C:\Program Files\A?pPatch
2007-11-12 11:56 . 2007-12-04 12:35 <DIR> d-------- C:\Program Files\Symantec
2007-11-12 11:56 . 2007-11-12 11:55 <DIR> d-------- C:\Program Files\M?crosoft
2007-11-12 11:56 . 2007-11-12 11:56 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\a?sembly
2007-11-12 11:56 . 2007-11-12 11:56 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\?racle
2007-11-12 11:55 . 2007-11-12 11:55 <DIR> d-------- C:\WINDOWS\ądobe
2007-11-12 11:55 . 2004-11-09 23:24 <DIR> d---s---- C:\WINDOWS\system32\Microsoft
2007-11-12 11:55 . 2007-11-12 11:55 <DIR> d-------- C:\WINDOWS\system32\?asks
2007-11-12 11:55 . 2007-07-20 09:18 <DIR> d-------- C:\WINDOWS\Microsoft.NET
2007-11-12 11:55 . 2007-11-12 11:55 <DIR> d-------- C:\WINDOWS\M?crosoft
2007-11-12 11:55 . 2005-09-22 12:35 <DIR> d---s---- C:\WINDOWS\Tasks
2007-11-12 11:55 . 2006-05-03 16:47 <DIR> d-------- C:\WINDOWS\security
2007-11-12 11:55 . 2007-11-12 11:55 <DIR> d-------- C:\Program Files\s?curity
2007-11-12 11:55 . 2005-09-22 13:18 <DIR> d-------- C:\Program Files\Microsoft.NET
2007-11-12 11:55 . 2007-11-12 11:55 <DIR> d-------- C:\Program Files\M?crosoft
2007-11-12 11:55 . 2007-11-12 11:55 <DIR> d-------- C:\Program Files\Common Files\ąppPatch
2007-11-12 11:55 . 2007-11-12 11:55 <DIR> d-------- C:\Program Files\Common Files\ądobe
2007-11-12 11:55 . 2007-06-13 08:02 <DIR> d-------- C:\Program Files\Common Files\System
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-10 14:40 0 ----a-w C:\WINDOWS\system32\drivers\WFTDriverLog.txt
2007-12-09 01:20 --------- d-----w C:\Program Files\Norton SystemWorks
2007-12-04 17:37 --------- d-----w C:\Program Files\Google
2007-12-04 17:35 123,952 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2007-12-04 17:35 --------- d-----w C:\Program Files\Symantec
2007-12-04 17:32 --------- d-----w C:\Program Files\Java
2007-11-12 17:03 --------- d-----w C:\Program Files\Common Files\??sks
2007-11-12 17:02 --------- d-----w C:\Program Files\??stem
2007-11-12 16:59 --------- d-----w C:\Program Files\Common Files\?ssembly
2007-11-12 16:59 --------- d-----w C:\Program Files\?ppPatch
2007-11-12 16:59 --------- d-----w C:\Program Files\??sks
2007-11-12 16:58 --------- d-----w C:\Program Files\?ppPatch
2007-11-12 16:58 --------- d-----w C:\Program Files\?dobe
2007-11-12 16:58 --------- d-----w C:\Program Files\??sks
2007-11-12 16:58 --------- d-----w C:\Program Files\??crosoft.NET
2007-11-12 16:58 --------- d-----w C:\Program Files\??crosoft
2007-11-12 16:58 --------- d-----w C:\Documents and Settings\Administrator\Application Data\?icrosoft
2007-11-12 16:57 --------- d-----w C:\Program Files\Common Files\?ymantec
2007-11-12 16:57 --------- d-----w C:\Program Files\Common Files\??pPatch
2007-11-12 16:57 --------- d-----w C:\Program Files\Common Files\??crosoft
2007-11-12 16:57 --------- d-----w C:\Documents and Settings\Administrator\Application Data\??curity
2007-11-12 16:56 --------- d-----w C:\Program Files\Common Files\?racle
2007-11-12 16:56 --------- d-----w C:\Program Files\Common Files\?icrosoft.NET
2007-11-12 16:56 --------- d-----w C:\Program Files\Common Files\?icrosoft
2007-11-12 16:56 --------- d-----w C:\Program Files\Common Files\?ecurity
2007-11-12 16:56 --------- d-----w C:\Program Files\Common Files\??mantec
2007-11-12 16:56 --------- d-----w C:\Program Files\Common Files\??crosoft.NET
2007-11-12 16:56 --------- d-----w C:\Program Files\?ecurity
2007-11-12 16:56 --------- d-----w C:\Program Files\??stem32
2007-11-12 16:56 --------- d-----w C:\Program Files\??pPatch
2007-11-12 16:56 --------- d-----w C:\Program Files\??mantec
2007-11-12 16:56 --------- d-----w C:\Program Files\??crosoft
2007-11-12 16:56 --------- d-----w C:\Documents and Settings\Administrator\Application Data\?racle
2007-11-12 16:55 --------- d-----w C:\Program Files\Common Files\?racle
2007-11-12 16:55 --------- d-----w C:\Program Files\Common Files\?ppPatch
2007-11-12 16:55 --------- d-----w C:\Program Files\Common Files\?icrosoft
2007-11-12 16:55 --------- d-----w C:\Program Files\Common Files\?dobe
2007-11-12 16:55 --------- d-----w C:\Program Files\Common Files\??stem
2007-11-12 16:55 --------- d-----w C:\Program Files\Common Files\??sembly
2007-11-12 16:55 --------- d-----w C:\Program Files\Common Files\??pPatch
2007-11-12 16:55 --------- d-----w C:\Program Files\Common Files\??mbols
2007-11-12 16:55 --------- d-----w C:\Program Files\?ymantec
2007-11-12 16:55 --------- d-----w C:\Program Files\?ssembly
2007-11-12 16:55 --------- d-----w C:\Program Files\?icrosoft.NET
2007-11-12 16:55 --------- d-----w C:\Program Files\?icrosoft
2007-11-12 16:55 --------- d-----w C:\Program Files\??sembly
2007-11-12 16:55 --------- d-----w C:\Program Files\??curity
2007-11-12 16:54 --------- d-----w C:\Program Files\Common Files\?ystem32
2007-11-12 16:54 --------- d-----w C:\Program Files\Common Files\?ymbols
2007-11-12 16:54 --------- d-----w C:\Program Files\Common Files\??stem32
2007-11-12 16:54 --------- d-----w C:\Program Files\Common Files\??curity
2007-11-12 16:54 --------- d-----w C:\Program Files\Common Files\??crosoft.NET
2007-11-12 16:54 --------- d-----w C:\Program Files\Common Files\??crosoft
2007-11-12 16:54 --------- d-----w C:\Program Files\?ystem
2007-11-12 16:54 --------- d-----w C:\Program Files\?racle
2007-11-12 16:54 --------- d-----w C:\Program Files\?racle
2007-11-12 16:54 --------- d-----w C:\Program Files\?icrosoft
2007-11-12 16:54 --------- d-----w C:\Program Files\?asks
2007-11-12 16:54 --------- d-----w C:\Program Files\??pPatch
2007-11-12 16:54 --------- d-----w C:\Program Files\??mbols
2007-11-12 16:54 --------- d-----w C:\Program Files\??crosoft.NET
2007-11-12 16:54 --------- d-----w C:\Documents and Settings\Administrator\Application Data\??crosoft.NET
2007-11-12 16:54 --------- d-----w C:\Documents and Settings\Administrator\Application Data\??crosoft
2007-11-12 16:53 --------- d-----w C:\Program Files\Common Files\?ystem
2007-11-12 16:53 --------- d-----w C:\Program Files\Common Files\?ppPatch
2007-11-12 16:53 --------- d-----w C:\Program Files\Common Files\?icrosoft.NET
2007-11-12 16:53 --------- d-----w C:\Program Files\Common Files\?dobe
2007-11-12 16:53 --------- d-----w C:\Program Files\Common Files\?asks
2007-11-12 16:53 --------- d-----w C:\Program Files\Common Files\?asks
2007-11-12 16:53 --------- d-----w C:\Program Files\Common Files\??sks
2007-11-12 16:53 --------- d-----w C:\Program Files\?ystem32
2007-11-12 16:53 --------- d-----w C:\Program Files\?ymbols
2007-11-12 16:53 --------- d-----w C:\Program Files\?icrosoft.NET
2007-11-12 16:53 --------- d-----w C:\Program Files\?dobe
2007-11-12 16:53 --------- d-----w C:\Program Files\?asks
2007-11-12 16:53 --------- d-----w C:\Documents and Settings\Administrator\Application Data\?icrosoft.NET
2007-11-12 16:53 --------- d-----w C:\Documents and Settings\Administrator\Application Data\?asks
2007-11-12 16:53 --------- d-----w C:\Documents and Settings\Administrator\Application Data\??stem32
2007-11-12 16:53 --------- d-----w C:\Documents and Settings\Administrator\Application Data\??stem
2007-11-12 16:53 --------- d-----w C:\Documents and Settings\Administrator\Application Data\??sks
2007-11-12 16:53 --------- d-----w C:\Documents and Settings\Administrator\Application Data\??mbols
2007-11-12 16:53 --------- d-----w C:\Documents and Settings\Administrator\Application Data\??mantec
2007-10-30 15:09 --------- d-----w C:\Program Files\DivX
2007-10-30 14:55 --------- d-----w C:\Documents and Settings\Administrator\Application Data\DivX
2007-10-25 15:26 53,248 ----a-w C:\WINDOWS\bdoscandel.exe
2007-10-23 18:32 --------- d-----w C:\Documents and Settings\All Users\Application Data\nView_Profiles
2007-09-20 14:59 972,072 ----a-w C:\WINDOWS\UNRecode.exe
2007-09-20 14:55 972,072 ----a-w C:\WINDOWS\UNNeroMediaHome.exe
2005-09-22 17:34 32 --sha-w C:\WINDOWS\{188D46AD-BCED-447F-B20E-60F5CB32313C}.dat
2005-09-22 17:35 32 --sha-w C:\WINDOWS\{24A1CF26-2E6E-4375-B834-4B5524A92BF4}.dat
2005-09-22 17:34 32 --sha-w C:\WINDOWS\{4D92E012-78E3-4CD6-A27C-186497D1056B}.dat
2005-09-22 17:34 32 --sha-w C:\WINDOWS\system32\{C21790DB-1E75-41C2-B1A2-71C0D2E9AEF2}.dat
2005-09-22 17:35 32 --sha-w C:\WINDOWS\system32\{C8405FC4-02DD-4CD2-AEAB-5A1BB4900910}.dat
2005-09-22 17:34 32 --sha-w C:\WINDOWS\system32\{F6225B7E-ACDF-4245-8EE2-F1A674B16F9F}.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\{AC887BC4-A887-455F-AA89-B2B3B71979B4}]
@=Mediafour Mac Volume Icons
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:00]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe" [2007-09-20 15:35]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46]
"mount.exe"="C:\Program Files\GiPo@Utilities\GiPo@FileUtilities\mount.exe" [2003-05-24 02:09]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Smapp"="C:\Program Files\Analog Devices\SoundMAX\SMTray.exe" [2003-05-05 11:57]
"DrvLsnr"="C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe" [2003-05-08 07:34]
"PRONoMgrWired"="c:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe" [2004-03-02 14:49]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2005-02-25 04:33]
"vptray"="C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe" [2002-07-30 10:35]
"Blackmagic CheckVersion PCI"="C:\Program Files\Blackmagic Design\Blackmagic DeckLink\CheckVersionPCI.exe" [2006-04-10 15:05]
"DigidesignMMERefresh"="C:\Program Files\Digidesign\Drivers\MMERefresh.exe" [2006-02-14 23:31]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-15 14:05]
"Mediafour Mac Volume Notifications"="C:\Program Files\Common Files\Mediafour\MACVNTFY.exe" [2002-07-02 13:31]
"NvCplDaemon"="RUNDLL32.exe" [2004-08-04 02:00 C:\WINDOWS\system32\rundll32.exe]
"nwiz"="nwiz.exe" [2006-03-17 13:16 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="RUNDLL32.exe" [2004-08-04 02:00 C:\WINDOWS\system32\rundll32.exe]
"NeroFilterCheck"="C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 15:57]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-09-20 09:51]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\efcbyax]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pkyearhj]
pkyearhj.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Administrator^Start Menu^Programs^Startup^UMAX VistaAccess.lnk]
path=C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\UMAX VistaAccess.lnk
backup=C:\WINDOWS\pss\UMAX VistaAccess.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Getting Started with MacDrive 5.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Getting Started with MacDrive 5.lnk
backup=C:\WINDOWS\pss\Getting Started with MacDrive 5.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\53062b4b]
rundll32.exe C:\WINDOWS\system32\ahhitmqb.dll,b
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2007-05-11 02:06 40048 --a------ C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Promon.exe]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WebBuying]
C:\Program Files\Web Buying\v1.8.5\webbuying.exe
R0 MDPMGRNT;MDPMGRNT;C:\WINDOWS\system32\drivers\MDPMGRNT.sys
R2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3;C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
R3 Flamethrower;Flamethrower;C:\WINDOWS\system32\drivers\Flamethrower.sys
R3 LaCieFWFilter;Silver 1394 Filter (1394 BUS Filter Driver);C:\WINDOWS\system32\DRIVERS\LaCieFWFilter.sys
R3 LaCieUSBFilter;Silver USB Filter (USB BUS Filter Driver);C:\WINDOWS\system32\DRIVERS\LaCieUSBFilter.sys
S1 AEC671X;AEC671X;C:\WINDOWS\system32\drivers\AEC671X.SYS
S1 BMDPDisk;BMDPDisk;C:\WINDOWS\system32\drivers\BMDPDisk.sys
S1 DMX3191;DMX3191;C:\WINDOWS\system32\drivers\DMX3191.SYS
S2 BMDPBox;BMDPBox;C:\WINDOWS\system32\drivers\BMDPBox.sys
S2 UDNT;UDNT;C:\WINDOWS\system32\drivers\UDNT.sys
S3 BMDDeckLinkAudio;BMDDeckLinkAudio;C:\WINDOWS\system32\DRIVERS\deckaud.sys
S3 BMDDeckLinkSerial;BMDDeckLinkSerial;C:\WINDOWS\system32\DRIVERS\deckser.sys
S3 DeckLink;DeckLink;C:\WINDOWS\system32\DRIVERS\DeckLink.sys
S3 DeckLinkDisplay;DeckLinkDisplay;C:\WINDOWS\system32\DRIVERS\deckmp.sys
S3 MDFSYSNT;MDFSYSNT;C:\WINDOWS\system32\drivers\MDFSYSNT.sys
S3 NPDriver;Norton Unerase Protection Driver;\??\C:\WINDOWS\system32\Drivers\NPDRIVER.SYS
.
Contents of the 'Scheduled Tasks' folder
"2007-12-09 01:20:10 C:\WINDOWS\Tasks\Norton SystemWorks One Button Checkup.job"
- C:\Program Files\Norton SystemWorks\OBC.exe
.
**************************************************************************
catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2007-12-10 09:41:37
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\NavLogon.dll
.
Completion time: 2007-12-10 9:43:18 - machine was rebooted
.
--- E O F --- 2007-11-14 14:05:22
Logfile of HijackThis v1.99.1
Scan saved at 9:45:37 AM, on 12/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\AvidSDMService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Digidesign\Drivers\MMERefresh.exe
C:\Program Files\FolderSize\FolderSizeSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Tablet.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\Blackmagic Design\Blackmagic DeckLink\CheckVersionPCI.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Mediafour\MACVNTFY.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\Downloads\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [DrvLsnr] C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
O4 - HKLM\..\Run: [PRONoMgrWired] c:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [Blackmagic CheckVersion PCI] C:\Program Files\Blackmagic Design\Blackmagic DeckLink\CheckVersionPCI.exe
O4 - HKLM\..\Run: [DigidesignMMERefresh] C:\Program Files\Digidesign\Drivers\MMERefresh.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Mediafour Mac Volume Notifications] "C:\Program Files\Common Files\Mediafour\MACVNTFY.EXE" /auto
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [mount.exe] C:\Program Files\GiPo@Utilities\GiPo@FileUtilities\mount.exe /z
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) -
http://download.bitdefender.com/reso...an8/oscan8.cab
O20 - Winlogon Notify: efcbyax - C:\WINDOWS\
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: pkyearhj - pkyearhj.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Avid SDM Service (AvidSDMService) - Avid Technology, Inc. - C:\WINDOWS\system32\AvidSDMService.exe
O23 - Service: Avid Startup (AvidStartup) - Unknown owner - C:\WINDOWS\system32\AvidStartup.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: Digidesign MME Refresh Service (DigiRefresh) - Digidesign, A Division of Avid Technology, Inc. - C:\Program Files\Digidesign\Drivers\MMERefresh.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Folder Size (FolderSize) - Brio - C:\Program Files\FolderSize\FolderSizeSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - c:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe