<https://forums.malwarebytes.com/topic/64228-rootkit-or-am-i-paranoid/#comment-323812>
<http://schema.org/text>
"Here is the log file. I know about two of the deletions: Gin_Toolbar is Old adware. I do run HP's ImageZone. I did reinstall some HP scanner software this month, as well as updated iTunes. ------------------------------------------ ComboFix 10-10-05.05 - Owner 10/06/2010   9:10.1.1 - x86 Microsoft Windows XP Home Edition  5.1.2600.2.1252.1.1033.18.2046.1229 [GMT -5:00] Running from: c:\\documents and settings\\Owner\\My Documents\\Downloads\\ComboFix.exe AV: Norton Internet Security *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8} FW: Norton Internet Security *enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220} . (((((((((((((((((((((((((((((((((((((((   Other Deletions   ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\\docume~1\\Owner\\LOCALS~1\\Temp\\IadHide5.dll c:\\documents and settings\\All Users\\Start Menu\\HP Image Zone .lnk c:\\documents and settings\\Owner\\Local Settings\\Temp\\IadHide5.dll c:\\windows\\100%_Free_Gin_Toolbar_Uninstaller_8484.exe c:\\windows\\system32\\_000008_.tmp.dll c:\\windows\\system32\\Thumbs.db D:\\Autorun.inf . (((((((((((((((((((((((((   Files Created from 2010-09-06 to 2010-10-06  ))))))))))))))))))))))))))))))) . 2010-10-05 14:24 . 2010-10-05 14:24\t161296\t----a-w-\tc:\\windows\\system32\\drivers\\tmcomm.sys 2010-09-28 21:51 . 2010-09-28 21:51\t128532\t---ha-w-\tc:\\windows\\system32\\mlfcache.dat 2010-09-28 21:26 . 2010-09-28 21:26\t--------\td-----w-\tc:\\program files\\iPod 2010-09-28 21:26 . 2010-09-28 21:27\t--------\td-----w-\tc:\\program files\\iTunes 2010-09-28 21:26 . 2010-09-28 21:27\t--------\td-----w-\tc:\\documents and settings\\All Users\\Application Data\\{429CAD59-35B1-4DBC-BB6D-1DB246563521} 2010-09-28 21:19 . 2010-09-28 21:19\t--------\td-----w-\tc:\\program files\\Apple Software Update 2010-09-24 07:51 . 2010-09-24 07:51\t73000\t----a-w-\tc:\\documents and settings\\All Users\\Application Data\\Apple Computer\\Installer Cache\\iTunes 10.0.1.22\\SetupAdmin.exe 2010-09-16 23:07 . 2010-09-16 23:07\t--------\td-----w-\tc:\\documents and settings\\LocalService\\Local Settings\\Application Data\\HP 2010-09-16 23:04 . 2010-09-16 23:04\t--------\td-----w-\tc:\\documents and settings\\All Users\\Application Data\\Sonic 2010-09-16 23:04 . 2010-09-16 23:04\t--------\td-----w-\tc:\\program files\\Common Files\\Sonic Shared 2010-09-16 22:31 . 2010-09-16 23:06\t76536\t----a-w-\tc:\\windows\\hpgins07.dat 2010-09-16 22:31 . 2005-05-25 06:51\t848\t------w-\tc:\\windows\\hpgmdl07.dat . ((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-10-06 14:26 . 2008-02-07 19:17\t--------\td-----w-\tc:\\documents and settings\\Owner\\Application Data\\WTablet 2010-10-06 02:47 . 2009-06-12 21:26\t--------\td-----w-\tc:\\documents and settings\\Owner\\Application Data\\FileZilla 2010-10-05 19:55 . 2008-02-11 15:58\t--------\td-----w-\tc:\\documents and settings\\LocalService\\Application Data\\WTablet 2010-10-04 22:44 . 2008-09-08 21:50\t--------\td-----w-\tc:\\program files\\Microsoft Silverlight 2010-09-29 15:04 . 2005-11-17 15:25\t184560\t----a-w-\tc:\\documents and settings\\Owner\\Local Settings\\Application Data\\GDIPFONTCACHEV1.DAT 2010-09-28 21:49 . 2005-10-06 00:54\t--------\td-----w-\tc:\\documents and settings\\Owner\\Application Data\\Apple Computer 2010-09-28 21:26 . 2010-03-02 00:37\t--------\td-----w-\tc:\\program files\\Common Files\\Apple 2010-09-28 21:22 . 2006-07-27 00:01\t--------\td-----w-\tc:\\program files\\QuickTime 2010-09-28 21:21 . 2005-10-06 00:51\t--------\td-----w-\tc:\\documents and settings\\All Users\\Application Data\\Apple Computer 2010-09-28 21:16 . 2007-08-03 18:56\t--------\td-----w-\tc:\\program files\\Bonjour 2010-09-28 14:19 . 2009-08-31 16:44\t--------\td-----w-\tc:\\documents and settings\\Owner\\Application Data\\HpUpdate 2010-09-18 16:44 . 2010-07-07 21:45\t--------\td-----w-\tc:\\program files\\WinMerge 2010-09-17 01:59 . 2005-08-04 18:35\t--------\td-----w-\tc:\\program files\\Google 2010-09-16 23:11 . 2009-07-26 02:39\t--------\td-----w-\tc:\\documents and settings\\Owner\\Application Data\\HP 2010-09-16 23:02 . 2009-07-26 00:43\t--------\td-----w-\tc:\\program files\\Common Files\\HP 2010-09-05 16:05 . 2005-11-11 22:14\t--------\td-----w-\tc:\\documents and settings\\Owner\\Application Data\\SmartFTP 2010-08-30 19:34 . 2010-09-06 18:03\t1496064\t----a-w-\tc:\\documents and settings\\Owner\\Application Data\\Mozilla\\Firefox\\Profiles\\y6p002qo.default\\extensions\\{3112ca9c-de6d-4884-a869-9855de68056c}\\components\\frozen.dll 2010-08-30 19:33 . 2010-09-06 18:03\t43008\t----a-w-\tc:\\documents and settings\\Owner\\Application Data\\Mozilla\\Firefox\\Profiles\\y6p002qo.default\\extensions\\{3112ca9c-de6d-4884-a869-9855de68056c}\\components\\googletoolbarloader.dll 2010-08-30 19:33 . 2010-09-06 18:03\t338944\t----a-w-\tc:\\documents and settings\\Owner\\Application Data\\Mozilla\\Firefox\\Profiles\\y6p002qo.default\\extensions\\{3112ca9c-de6d-4884-a869-9855de68056c}\\libraries\\googletoolbar-ff2.dll 2010-08-30 19:33 . 2010-09-06 18:03\t346112\t----a-w-\tc:\\documents and settings\\Owner\\Application Data\\Mozilla\\Firefox\\Profiles\\y6p002qo.default\\extensions\\{3112ca9c-de6d-4884-a869-9855de68056c}\\libraries\\googletoolbar-ff3.dll 2010-08-24 19:20 . 2009-07-26 00:34\t186607\t----a-w-\tc:\\windows\\hpwins23.dat 2010-08-19 21:38 . 2005-03-27 06:01\t--------\td-----w-\tc:\\program files\\Common Files\\Java 2010-08-19 21:33 . 2005-03-27 06:01\t--------\td-----w-\tc:\\program files\\Java 2010-08-17 16:55 . 2009-06-12 21:25\t--------\td-----w-\tc:\\program files\\FileZilla FTP Client 2010-08-06 14:23 . 2010-08-06 14:23\t61440\t----a-w-\tc:\\documents and settings\\Owner\\Application Data\\Sun\\Java\\Deployment\\SystemCache\\6.0\\42\\4488892a-62971399-n\\decora-sse.dll 2010-08-06 14:23 . 2010-08-06 14:23\t503808\t----a-w-\tc:\\documents and settings\\Owner\\Application Data\\Sun\\Java\\Deployment\\SystemCache\\6.0\\4\\7ec4bf04-7b67f1ea-n\\msvcp71.dll 2010-08-06 14:23 . 2010-08-06 14:23\t499712\t----a-w-\tc:\\documents and settings\\Owner\\Application Data\\Sun\\Java\\Deployment\\SystemCache\\6.0\\4\\7ec4bf04-7b67f1ea-n\\jmc.dll 2010-08-06 14:23 . 2010-08-06 14:23\t348160\t----a-w-\tc:\\documents and settings\\Owner\\Application Data\\Sun\\Java\\Deployment\\SystemCache\\6.0\\4\\7ec4bf04-7b67f1ea-n\\msvcr71.dll 2010-08-06 14:23 . 2010-08-06 14:23\t12800\t----a-w-\tc:\\documents and settings\\Owner\\Application Data\\Sun\\Java\\Deployment\\SystemCache\\6.0\\42\\4488892a-62971399-n\\decora-d3d.dll 2010-07-27 23:44 . 2010-07-27 23:44\t91424\t----a-w-\tc:\\windows\\system32\\dnssd.dll 2010-07-27 23:44 . 2010-07-27 23:44\t75040\t----a-w-\tc:\\windows\\system32\\jdns_sd.dll 2010-07-27 23:44 . 2010-07-27 23:44\t197920\t----a-w-\tc:\\windows\\system32\\dnssdX.dll 2010-07-27 23:44 . 2010-07-27 23:44\t107808\t----a-w-\tc:\\windows\\system32\\dns-sd.exe 2010-07-18 14:39 . 2010-07-18 14:30\t16304\t----a-w-\tc:\\windows\\system32\\Wacom_Tablet.dat 2010-07-17 10:00 . 2010-04-22 00:43\t423656\t----a-w-\tc:\\windows\\system32\\deployJava1.dll 2010-02-22 03:15 . 2006-11-02 14:12\t16946\t----a-w-\tc:\\program files\\PANTONEcolorbridge.log . (((((((((((((((((((((((((((((((((((((   Reg Loading Points   )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries &amp; legit default entries are not shown  REGEDIT4 [HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Toolbar\\Webbrowser] \"{BDE1999F-C91A-4F5D-8E3F-B7BB7624DCE8}\"= \"c:\\program files\\100% Free Gin Toolbar\\v2.0.0.2\\100%_Free_Gin_Toolbar.dll\" [2005-10-30 491520] [HKEY_CLASSES_ROOT\\clsid\\{bde1999f-c91a-4f5d-8e3f-b7bb7624dce8}] [HKEY_CLASSES_ROOT\\ToolBar.ToolBarObj.1] [HKEY_CLASSES_ROOT\\TypeLib\\{6E7786E8-7988-4487-B7D0-0AB4268E1A4A}] [HKEY_CLASSES_ROOT\\ToolBar.ToolBarObj] [HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run] \"Creative Detector\"=\"c:\\program files\\Creative\\MediaSource\\Detector\\CTDetect.exe\" [2004-12-03 102400] \"swg\"=\"c:\\program files\\Google\\GoogleToolbarNotifier\\GoogleToolbarNotifier.exe\" [2007-07-02 68856] \"Google Update\"=\"c:\\documents and settings\\Owner\\Local Settings\\Application Data\\Google\\Update\\GoogleUpdate.exe\" [2009-01-15 133104] [HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run] \"NeroFilterCheck\"=\"c:\\windows\\system32\\NeroCheck.exe\" [2001-07-09 155648] \"SynTPLpr\"=\"c:\\program files\\Synaptics\\SynTP\\SynTPLpr.exe\" [2004-11-04 98394] \"SynTPEnh\"=\"c:\\program files\\Synaptics\\SynTP\\SynTPEnh.exe\" [2004-11-04 688218] \"Recguard\"=\"c:\\windows\\SMINST\\RECGUARD.EXE\" [2002-09-14 212992] \"ATIPTA\"=\"c:\\program files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe\" [2005-02-02 339968] \"HPDJ Taskbar Utility\"=\"c:\\windows\\system32\\spool\\drivers\\w32x86\\3\\hpztsb08.exe\" [2003-03-26 172032] \"EPSON Stylus CX4200 Series\"=\"c:\\windows\\System32\\spool\\DRIVERS\\W32X86\\3\\E_FATIAEA.EXE\" [2005-03-08 98304] \"Windows Defender\"=\"c:\\program files\\Windows Defender\\MSASCui.exe\" [2006-11-04 866584] \"CTDVDDET\"=\"c:\\program files\\Creative\\Sound Blaster Audigy 2\\DVDAudio\\CTDVDDET.EXE\" [2003-06-18 45056] \"CTSysVol\"=\"c:\\program files\\Creative\\Sound Blaster Audigy 2\\Surround Mixer\\CTSysVol.exe\" [2005-09-15 57344] \"CTPCMCIASBUtility\"=\"c:\\program files\\Creative\\Sound Blaster Audigy 2\\PCMCIA Sound Blaster Utility\\CTSBUtl.exe\" [2005-09-05 147456] \"AudioDrvEmulator\"=\"c:\\program files\\Creative\\Shared Files\\Module Loader\\DLLML.exe\" [2005-06-17 49152] \"CTHelper\"=\"CTHELPER.EXE\" [2005-08-29 16384] \"Acrobat Assistant 8.0\"=\"c:\\program files\\Adobe\\Acrobat 8.0\\Acrobat\\Acrotray.exe\" [2010-06-16 624056] \"LifeCam\"=\"c:\\program files\\Microsoft LifeCam\\LifeExp.exe\" [2007-05-17 279912] \"TrueImageMonitor.exe\"=\"c:\\program files\\Acronis\\TrueImageHome\\TrueImageMonitor.exe\" [2008-11-22 4352832] \"AcronisTimounterMonitor\"=\"c:\\program files\\Acronis\\TrueImageHome\\TimounterMonitor.exe\" [2008-11-22 960528] \"Acronis Scheduler2 Service\"=\"c:\\program files\\Common Files\\Acronis\\Schedule2\\schedhlp.exe\" [2008-11-22 165144] \"HP Software Update\"=\"c:\\program files\\HP\\HP Software Update\\HPWuSchd2.exe\" [2010-03-12 49208] \"Adobe Reader Speed Launcher\"=\"c:\\program files\\Adobe\\Reader 9.0\\Reader\\Reader_sl.exe\" [2009-12-22 35760] \"Adobe ARM\"=\"c:\\program files\\Common Files\\Adobe\\ARM\\1.0\\AdobeARM.exe\" [2010-06-09 976832] \"SunJavaUpdateSched\"=\"c:\\program files\\Common Files\\Java\\Java Update\\jusched.exe\" [2010-05-14 248552] \"QuickTime Task\"=\"c:\\program files\\QuickTime\\QTTask.exe\" [2010-09-08 421888] \"iTunesHelper\"=\"c:\\program files\\iTunes\\iTunesHelper.exe\" [2010-09-24 421160] c:\\documents and settings\\All Users\\Start Menu\\Programs\\Startup\\ HP Digital Imaging Monitor.lnk - c:\\program files\\HP\\Digital Imaging\\bin\\hpqtra08.exe [2008-10-16 214360] HP Image Zone Fast Start.lnk - c:\\program files\\HP\\Digital Imaging\\bin\\hpqthb08.exe [2005-5-12 73728] KODAK Software Updater.lnk - c:\\program files\\Kodak\\KODAK Software Updater\\7288971\\Program\\Kodak Software Updater.exe [2004-2-13 16423] Spyder3Utility.lnk - c:\\program files\\Datacolor\\Spyder3Pro\\Utility\\Spyder3Utility.exe [2008-3-19 6333954] [hkey_local_machine\\software\\microsoft\\windows\\currentversion\\explorer\\ShellExecuteHooks] \"{EDB0E980-90BD-11D4-8599-0008C7D3B6F8}\"= \"c:\\program files\\Qualcomm\\Eudora\\EuShlExt.dll\" [2005-06-08 86016] [HKEY_LOCAL_MACHINE\\software\\microsoft\\windows nt\\currentversion\\drivers32] \"mixer\"=DrvTrNTm.dll \"wave\"=DrvTrNTm.dll [HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\Minimal\\WinDefend] @=\"Service\" [HKLM\\~\\startupfolder\\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AT&amp;T Self Support Tool.lnk] path=c:\\documents and settings\\All Users\\Start Menu\\Programs\\Startup\\AT&amp;T Self Support Tool.lnk backup=c:\\windows\\pss\\AT&amp;T Self Support Tool.lnkCommon Startup [HKLM\\~\\startupfolder\\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk] path=c:\\documents and settings\\All Users\\Start Menu\\Programs\\Startup\\Kodak EasyShare software.lnk backup=c:\\windows\\pss\\Kodak EasyShare software.lnkCommon Startup [HKLM\\~\\startupfolder\\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ZyXEL G-202 Wireless Adapter Utility.lnk] path=c:\\documents and settings\\All Users\\Start Menu\\Programs\\Startup\\ZyXEL G-202 Wireless Adapter Utility.lnk backup=c:\\windows\\pss\\ZyXEL G-202 Wireless Adapter Utility.lnkCommon Startup HKEY_LOCAL_MACHINE\\software\\microsoft\\shared tools\\msconfig\\startupreg\\C: HKEY_LOCAL_MACHINE\\software\\microsoft\\shared tools\\msconfig\\startupreg\\C:\\Program Files HKEY_LOCAL_MACHINE\\software\\microsoft\\shared tools\\msconfig\\startupreg\\c:\\program files\\1&amp;1 HKEY_LOCAL_MACHINE\\software\\microsoft\\shared tools\\msconfig\\startupreg\\c:\\program files\\1&amp;1\\1&amp;1 EasyLogin [HKEY_LOCAL_MACHINE\\software\\microsoft\\shared tools\\msconfig\\startupreg\\c:\\program files\\1&amp;1\\1&amp;1 EasyLogin\\EasyLogin.exe] 1&amp;1 EasyLogin HIDE [X] [HKEY_LOCAL_MACHINE\\software\\microsoft\\shared tools\\msconfig\\startupreg\\1&amp;1 EasyLogin] 2009-02-12 10:21\t2200576\t----a-w-\tc:\\program files\\1&amp;1\\1&amp;1 EasyLogin\\EasyLogin.exe [HKEY_LOCAL_MACHINE\\software\\microsoft\\shared tools\\msconfig\\startupreg\\CitiVAN] 2004-08-12 19:55\t192512\t----a-w-\tc:\\program files\\Citi Virtual Account Numbers\\CitiVAN.exe [HKEY_LOCAL_MACHINE\\software\\microsoft\\shared tools\\msconfig\\startupreg\\iTunesHelper] 2010-09-24 07:10\t421160\t----a-w-\tc:\\program files\\iTunes\\iTunesHelper.exe [HKEY_LOCAL_MACHINE\\software\\microsoft\\shared tools\\msconfig\\startupreg\\Messenger (Yahoo!)] 2009-03-18 23:50\t4363504\t----a-w-\tc:\\program files\\Yahoo!\\Messenger\\YahooMessenger.exe [HKEY_LOCAL_MACHINE\\software\\microsoft\\shared tools\\msconfig\\startupreg\\Motive SmartBridge] 2005-08-24 13:51\t442455\t----a-w-\tc:\\progra~1\\SBCSEL~1\\SMARTB~1\\MotiveSB.exe [HKEY_LOCAL_MACHINE\\software\\microsoft\\shared tools\\msconfig\\startupreg\\SmileboxTray] 2009-06-08 09:15\t266888\t----a-w-\tc:\\documents and settings\\Owner\\Application Data\\Smilebox\\SmileboxTray.exe [HKEY_LOCAL_MACHINE\\software\\microsoft\\shared tools\\msconfig\\startupreg\\swg] 2007-07-02 16:15\t68856\t----a-w-\tc:\\program files\\Google\\GoogleToolbarNotifier\\GoogleToolbarNotifier.exe [HKEY_LOCAL_MACHINE\\software\\microsoft\\shared tools\\msconfig\\startupreg\\TotalRecorderScheduler] 2006-12-06 02:49\t114688\t----a-w-\tc:\\program files\\HighCriteria\\TotalRecorder\\TotRecSched.exe [HKEY_LOCAL_MACHINE\\software\\microsoft\\security center\\Monitoring] \"DisableMonitoring\"=dword:00000001 [HKEY_LOCAL_MACHINE\\software\\microsoft\\security center\\Monitoring\\SymantecAntiVirus] \"DisableMonitoring\"=dword:00000001 [HKEY_LOCAL_MACHINE\\software\\microsoft\\security center\\Monitoring\\SymantecFirewall] \"DisableMonitoring\"=dword:00000001 [HKLM\\~\\services\\sharedaccess\\parameters\\firewallpolicy\\standardprofile] \"EnableFirewall\"= 0 (0x0) [HKLM\\~\\services\\sharedaccess\\parameters\\firewallpolicy\\standardprofile\\AuthorizedApplications\\List] \"c:\\\\Program Files\\\\SmartFTP\\\\SmartFTP.exe\"= \"c:\\\\WINDOWS\\\\system32\\\\sessmgr.exe\"= \"c:\\\\Program Files\\\\Common Files\\\\Adobe\\\\Adobe Version Cue CS3\\\\Server\\\\bin\\\\VersionCueCS3.exe\"= \"%windir%\\\\Network Diagnostic\\\\xpnetdiag.exe\"= \"c:\\\\Program Files\\\\Kodak\\\\Kodak EasyShare software\\\\bin\\\\EasyShare.exe\"= \"c:\\\\Program Files\\\\HP\\\\Digital Imaging\\\\bin\\\\hpqtra08.exe\"= \"c:\\\\Program Files\\\\HP\\\\Digital Imaging\\\\bin\\\\hpqste08.exe\"= \"c:\\\\Program Files\\\\HP\\\\Digital Imaging\\\\bin\\\\hpofxm08.exe\"= \"c:\\\\Program Files\\\\HP\\\\Digital Imaging\\\\bin\\\\hposfx08.exe\"= \"c:\\\\Program Files\\\\HP\\\\Digital Imaging\\\\bin\\\\hposid01.exe\"= \"c:\\\\Program Files\\\\HP\\\\Digital Imaging\\\\bin\\\\hpqkygrp.exe\"= \"c:\\\\Program Files\\\\HP\\\\Digital Imaging\\\\bin\\\\hpzwiz01.exe\"= \"c:\\program files\\Microsoft ActiveSync\\rapimgr.exe\"= c:\\program files\\Microsoft ActiveSync\\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager \"c:\\program files\\Microsoft ActiveSync\\wcescomm.exe\"= c:\\program files\\Microsoft ActiveSync\\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager \"c:\\program files\\Microsoft ActiveSync\\WCESMgr.exe\"= c:\\program files\\Microsoft ActiveSync\\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application \"c:\\\\Program Files\\\\Microsoft LifeCam\\\\LifeCam.exe\"= \"c:\\\\Program Files\\\\Microsoft LifeCam\\\\LifeExp.exe\"= \"c:\\\\Program Files\\\\Pando Networks\\\\Media Booster\\\\PMB.exe\"= \"c:\\\\Program Files\\\\HP\\\\Digital Imaging\\\\{FA0F0A01-4631-4161-A6C2-948BF694382E}\\\\setup\\\\hpznui01.exe\"= \"c:\\\\Program Files\\\\Bonjour\\\\mDNSResponder.exe\"= \"c:\\\\Program Files\\\\iTunes\\\\iTunes.exe\"= [HKLM\\~\\services\\sharedaccess\\parameters\\firewallpolicy\\standardprofile\\GloballyOpenPorts\\List] \"3389:TCP\"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009 \"3703:TCP\"= 3703:TCP:Adobe Version Cue CS3 Server \"3704:TCP\"= 3704:TCP:Adobe Version Cue CS3 Server \"50900:TCP\"= 50900:TCP:Adobe Version Cue CS3 Server \"50901:TCP\"= 50901:TCP:Adobe Version Cue CS3 Server \"26675:TCP\"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service \"58977:TCP\"= 58977:TCP:Pando Media Booster \"58977:UDP\"= 58977:UDP:Pando Media Booster R0 SymDS;Symantec Data Store;c:\\windows\\system32\\drivers\\NIS\\1108000.005\\symds.sys [9/24/2010 10:05 AM 328752] R0 SymEFA;Symantec Extended File Attributes;c:\\windows\\system32\\drivers\\NIS\\1108000.005\\symefa.sys [9/24/2010 10:05 AM 173104] R1 BHDrvx86;BHDrvx86;c:\\documents and settings\\All Users\\Application Data\\Norton\\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\\NIS_17.0.0.136\\Definitions\\BASHDefs\\20101001.001\\BHDrvx86.sys [10/5/2010 5:14 PM 692272] R1 ccHP;Symantec Hash Provider;c:\\windows\\system32\\drivers\\NIS\\1108000.005\\cchpx86.sys [9/24/2010 10:05 AM 501888] R1 NEOFLTR_540_11529;Juniper Networks TDI Filter Driver (NEOFLTR_540_11529);c:\\windows\\system32\\drivers\\NEOFLTR_540_11529.sys [1/29/2007 8:33 PM 57591] R1 SymIRON;Symantec Iron Driver;c:\\windows\\system32\\drivers\\NIS\\1108000.005\\ironx86.sys [9/24/2010 10:05 AM 116784] R2 NIS;Norton Internet Security;c:\\program files\\Norton Internet Security\\Engine\\17.8.0.5\\ccsvchst.exe [9/24/2010 10:05 AM 126392] R2 TabletServiceWacom;TabletServiceWacom;c:\\windows\\system32\\Wacom_Tablet.exe [12/25/2009 11:12 AM 5010288] R2 WinDefend;Windows Defender;c:\\program files\\Windows Defender\\MsMpEng.exe [11/3/2006 7:19 PM 13592] R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\\program files\\Common Files\\Symantec Shared\\EENGINE\\EraserUtilRebootDrv.sys [5/29/2010 5:56 AM 102448] R3 IDSxpx86;IDSxpx86;c:\\documents and settings\\All Users\\Application Data\\Norton\\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\\NIS_17.0.0.136\\Definitions\\IPSDefs\\20101005.004\\IDSXpx86.sys [10/6/2010 8:24 AM 331640] R3 wacmoumonitor;Wacom Mode Helper;c:\\windows\\system32\\drivers\\wacmoumonitor.sys [6/15/2009 9:19 AM 16168] S2 gupdate;Google Update Service (gupdate);c:\\program files\\Google\\Update\\GoogleUpdate.exe [6/9/2010 10:47 AM 136176] S3 CachemanXPService;CachemanXP;c:\\progra~1\\CACHEM~1\\CachemanXP.exe [12/31/2006 9:48 AM 208384] S3 Dhelfcssn;Dhelfcssn; [x] S3 GTIPCI21;GTIPCI21;c:\\windows\\system32\\drivers\\gtipci21.sys [5/3/2004 7:26 PM 80384] S3 MSHUSBVideo;NX6000/NX3000/VX7000 Filter Driver;c:\\windows\\system32\\drivers\\nx6000.sys [5/3/2009 5:20 PM 34136] S3 PortlUSB;PortlUSB;c:\\windows\\system32\\drivers\\SiriusUSB.sys [5/1/2008 11:18 AM 7552] S3 Spyder3;Datacolor Spyder3;c:\\windows\\system32\\drivers\\Spyder3.sys [3/19/2008 3:26 PM 12288] S3 WDC_SAM;WD SCSI Pass Thru driver;c:\\windows\\system32\\drivers\\wdcsam.sys [4/28/2010 12:50 PM 11520] [HKEY_LOCAL_MACHINE\\software\\microsoft\\windows nt\\currentversion\\svchost] HPZ12\tREG_MULTI_SZ   \tPml Driver HPZ12 Net Driver HPZ12 HPService\tREG_MULTI_SZ   \tHPSLPSVC hpdevmgmt\tREG_MULTI_SZ   \thpqcxs08 hpqddsvc . Contents of the 'Scheduled Tasks' folder 2010-10-06 c:\\windows\\Tasks\\GoogleUpdateTaskMachineCore.job - c:\\program files\\Google\\Update\\GoogleUpdate.exe [2010-06-09 11:00] 2010-10-06 c:\\windows\\Tasks\\GoogleUpdateTaskMachineUA.job - c:\\program files\\Google\\Update\\GoogleUpdate.exe [2010-06-09 11:00] 2010-10-05 c:\\windows\\Tasks\\GoogleUpdateTaskUserS-1-5-21-3923770298-4147761796-204207088-1003Core.job - c:\\documents and settings\\Owner\\Local Settings\\Application Data\\Google\\Update\\GoogleUpdate.exe [2009-01-15 20:34] 2010-10-06 c:\\windows\\Tasks\\GoogleUpdateTaskUserS-1-5-21-3923770298-4147761796-204207088-1003UA.job - c:\\documents and settings\\Owner\\Local Settings\\Application Data\\Google\\Update\\GoogleUpdate.exe [2009-01-15 20:34] 2010-10-06 c:\\windows\\Tasks\\MP Scheduled Scan.job - c:\\program files\\Windows Defender\\MpCmdRun.exe [2006-11-04 00:20] 2010-10-03 c:\\windows\\Tasks\\Norton Internet Security - Owner - Full System Scan.job - c:\\program files\\Norton Internet Security\\Engine\\17.8.0.5\\navw32.exe [2010-09-24 19:24] . . ------- Supplementary Scan ------- . uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&amp;sourceid=ie7&amp;rls=com.microsoft:en-US&amp;ie=utf8&amp;oe=utf8 uStart Page = hxxp://www.google.com/ mStart Page = hxxp://www.yahoo.com uInternet Connection Wizard,ShellNext = hxxp://www.google.com/ uInternet Settings,ProxyOverride = 127.0.0.1;*.local IE: Append to existing PDF - c:\\program files\\Adobe\\Acrobat 8.0\\Acrobat\\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert link target to Adobe PDF - c:\\program files\\Adobe\\Acrobat 8.0\\Acrobat\\AcroIEFavClient.dll/AcroIECapture.html IE: Convert link target to existing PDF - c:\\program files\\Adobe\\Acrobat 8.0\\Acrobat\\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert selected links to Adobe PDF - c:\\program files\\Adobe\\Acrobat 8.0\\Acrobat\\AcroIEFavClient.dll/AcroIECaptureSelLinks.html IE: Convert selected links to existing PDF - c:\\program files\\Adobe\\Acrobat 8.0\\Acrobat\\AcroIEFavClient.dll/AcroIEAppendSelLinks.html IE: Convert selection to Adobe PDF - c:\\program files\\Adobe\\Acrobat 8.0\\Acrobat\\AcroIEFavClient.dll/AcroIECapture.html IE: Convert selection to existing PDF - c:\\program files\\Adobe\\Acrobat 8.0\\Acrobat\\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert to Adobe PDF - c:\\program files\\Adobe\\Acrobat 8.0\\Acrobat\\AcroIEFavClient.dll/AcroIECapture.html IE: Google Sidewiki... - c:\\program files\\Google\\Google Toolbar\\Component\\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html IE: {{A453794C-C643-4295-98A5-597CFC8D72EC} - c:\\program files\\Mail This Page\\MailThisPage.exe Trusted Zone: yahoo.com\\games TCP: {31DF49E6-0FC2-48E5-88C4-B5EE26A41961} = 68.94.156.1,68.94.157.1 DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} - hxxp://download.zonelabs.com/bin/promotions/spywaredetector/ICSScanner37350.cab DPF: {BEC2768D-297F-4A58-B004-DC0637A60F88} - hxxp://uwhbld-straweb.uwhis.hosp.wisc.edu/stratacap7/SCapEC7.CAB FF - ProfilePath - c:\\documents and settings\\Owner\\Application Data\\Mozilla\\Firefox\\Profiles\\y6p002qo.default\\ FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&amp;ie=UTF-8&amp;oe=UTF-8&amp;q= FF - prefs.js: browser.search.selectedEngine - Yahoo FF - component: c:\\documents and settings\\All Users\\Application Data\\Norton\\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\\NIS_17.0.0.136\\coFFPlgn\\components\\coFFPlgn.dll FF - component: c:\\documents and settings\\All Users\\Application Data\\Norton\\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\\NIS_17.0.0.136\\IPSFFPlgn\\components\\IPSFFPl.dll FF - component: c:\\documents and settings\\Owner\\Application Data\\Mozilla\\Firefox\\Profiles\\y6p002qo.default\\extensions\\{3112ca9c-de6d-4884-a869-9855de68056c}\\components\\frozen.dll FF - component: c:\\documents and settings\\Owner\\Application Data\\Mozilla\\Firefox\\Profiles\\y6p002qo.default\\extensions\\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\\platform\\WINNT_x86-msvc\\components\\ipc_fireftp.dll FF - plugin: c:\\documents and settings\\Owner\\Application Data\\Facebook\\npfbplugin_1_0_1.dll FF - plugin: c:\\documents and settings\\Owner\\Application Data\\Mozilla\\Firefox\\Profiles\\y6p002qo.default\\extensions\\moveplayer@movenetworks.com\\platform\\WINNT_x86-msvc\\plugins\\npmnqmp07061050.dll FF - plugin: c:\\documents and settings\\Owner\\Local Settings\\Application Data\\Google\\Update\\1.2.183.29\\npGoogleOneClick8.dll FF - plugin: c:\\documents and settings\\Owner\\Local Settings\\Application Data\\Yahoo!\\BrowserPlus\\2.9.8\\Plugins\\npybrowserplus_2.9.8.dll FF - plugin: c:\\program files\\Google\\Google Earth\\plugin\\npgeplugin.dll FF - plugin: c:\\program files\\Google\\Update\\1.2.183.29\\npGoogleOneClick8.dll FF - plugin: c:\\program files\\Java\\jre6\\bin\\new_plugin\\npdeployJava1.dll FF - plugin: c:\\program files\\Mozilla Firefox\\plugins\\npCouponPrinter.dll FF - plugin: c:\\program files\\Mozilla Firefox\\plugins\\npPandoWebInst.dll FF - plugin: c:\\program files\\Opera\\program\\plugins\\npdivx32.dll FF - plugin: c:\\program files\\Opera\\program\\plugins\\npdrmv2.dll FF - plugin: c:\\program files\\TabletPlugins\\npwacom.dll FF - plugin: c:\\program files\\Viewpoint\\Viewpoint Media Player\\npViewpoint.dll FF - plugin: c:\\program files\\Virtual Earth 3D\\npVE3D.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\\windows\\Microsoft.NET\\Framework\\v3.5\\Windows Presentation Foundation\\DotNetAssistantExtension\\ ---- FIREFOX POLICIES ---- c:\\program files\\Mozilla Firefox\\greprefs\\all.js - pref(\"network.IDN.whitelist.xn--mgbaam7a8h\", true);  c:\\program files\\Mozilla Firefox\\greprefs\\all.js - pref(\"network.IDN.whitelist.xn--mgberp4a5d4ar\", true);  c:\\program files\\Mozilla Firefox\\defaults\\pref\\firefox.js - pref(\"dom.ipc.plugins.enabled\", false); . - - - - ORPHANS REMOVED - - - - HKCU-Run-updateMgr - c:\\program files\\Adobe\\Acrobat 7.0\\Reader\\AdobeUpdateManager.exe HKCU-Run-Search Protection - c:\\program files\\Yahoo!\\Search Protection\\SearchProtection.exe HKLM-Run-WindowsTelemetry - c:\\program files\\Microsoft Windows Feedback Panel\\\\WFPUser.exe AddRemove-100% Free Gin Toolbar - c:\\windows\\100%_Free_Gin_Toolbar_Uninstaller_8484.exe AddRemove-Adobe Illustrator 9.0 - c:\\documents and settings\\owner\\desktop\\Uninst.isu AddRemove-FreeGin_is1 - c:\\windows\\100%_Free_Gin_Toolbar_Uninstaller_8484.exe [HKEY_LOCAL_MACHINE\\System\\ControlSet001\\Services\\NIS] \"ImagePath\"=\"\\\"c:\\program files\\Norton Internet Security\\Engine\\17.8.0.5\\ccSvcHst.exe\\\" /s \\\"NIS\\\" /m \\\"c:\\program files\\Norton Internet Security\\Engine\\17.8.0.5\\diMaster.dll\\\" /prefetch:1\" . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - &gt; 'winlogon.exe'(720) c:\\windows\\system32\\Ati2evxx.dll - - - - - - - &gt; 'explorer.exe'(2844) c:\\windows\\system32\\WININET.dll c:\\windows\\system32\\ieframe.dll c:\\windows\\system32\\WPDShServiceObj.dll c:\\program files\\SmartFTP\\smarthook.dll c:\\windows\\system32\\PortableDeviceTypes.dll c:\\windows\\system32\\PortableDeviceApi.dll c:\\windows\\system32\\browselc.dll c:\\program files\\Pro Imaging Powertoys\\Microsoft RAW Image Thumbnailer and Viewer for Windows XP\\CRawViewerExtension.dll c:\\program files\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.dll c:\\windows\\WinSxS\\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\\MSVCR80.dll c:\\program files\\Microsoft Office\\OFFICE11\\msohev.dll . ------------------------ Other Running Processes ------------------------ . c:\\windows\\system32\\Ati2evxx.exe c:\\windows\\System32\\SCardSvr.exe c:\\program files\\Common Files\\Acronis\\Schedule2\\schedul2.exe c:\\program files\\Common Files\\Apple\\Mobile Device Support\\AppleMobileDeviceService.exe c:\\program files\\Bonjour\\mDNSResponder.exe c:\\windows\\system32\\CTsvcCDA.EXE c:\\windows\\system32\\Ati2evxx.exe c:\\program files\\Java\\jre6\\bin\\jqs.exe c:\\program files\\Microsoft LifeCam\\MSCamS32.exe c:\\program files\\Common Files\\New Boundary\\PrismXL\\PRISMXL.SYS c:\\program files\\Smith Micro\\StuffIt11\\ArcNameService.exe c:\\program files\\Yahoo!\\SoftwareUpdate\\YahooAUService.exe c:\\windows\\system32\\wscntfy.exe c:\\program files\\Common Files\\Macrovision Shared\\FLEXnet Publisher\\FNPLicensingService.exe c:\\program files\\Microsoft ActiveSync\\wcescomm.exe c:\\progra~1\\MI3AA1~1\\rapimgr.exe c:\\program files\\HP\\Digital Imaging\\bin\\hpqimzone.exe c:\\program files\\iPod\\bin\\iPodService.exe c:\\program files\\HP\\Digital Imaging\\bin\\hpqSTE08.exe c:\\program files\\HP\\Digital Imaging\\bin\\hpqbam08.exe c:\\program files\\HP\\Digital Imaging\\bin\\hpqgpc01.exe . ************************************************************************** . Completion time: 2010-10-06  09:45:55 - machine was rebooted ComboFix-quarantined-files.txt  2010-10-06 14:45 Pre-Run: 13,690,417,152 bytes free Post-Run: 18,057,367,552 bytes free WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\\WINDOWS [operating systems] c:\\cmdcons\\BOOTSECT.DAT=\"Microsoft Windows Recovery Console\" /cmdcons UnsupportedDebug=\"do not select this\" /debug multi(0)disk(0)rdisk(0)partition(1)\\WINDOWS=\"Microsoft Windows XP Home Edition\" /noexecute=optin /fastdetect /bootlog - - End Of File - - 20FB2675BB8CCC89DDA026E9E5B33228 "
<https://forums.malwarebytes.com/topic/64228-rootkit-or-am-i-paranoid/>