<https://forums.malwarebytes.com/topic/64228-rootkit-or-am-i-paranoid/#comment-323838>
<http://schema.org/text>
"I did as you directed, turned router and machine off, waited a few minutes, rebooted, turned off Windows Defender and Norton.  Combofix did indeed update itself. Found and deleted iTunes folder stuff. Machine seems to be running at normal speed after shut down of router. Here is new CF log file. ============================================================================= ComboFix 10-10-05.06 - Owner 10/06/2010  10:43:01.2.1 - x86 Microsoft Windows XP Home Edition  5.1.2600.2.1252.1.1033.18.2046.1372 [GMT -5:00] Running from: c:\\documents and settings\\Owner\\Desktop\\ComboFix.exe Command switches used :: c:\\documents and settings\\Owner\\Desktop\\CFScript.txt AV: Norton Internet Security *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8} FW: Norton Internet Security *disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220} . (((((((((((((((((((((((((((((((((((((((   Other Deletions   ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\\documents and settings\\All Users\\Application Data\\{429CAD59-35B1-4DBC-BB6D-1DB246563521} c:\\documents and settings\\All Users\\Application Data\\{429CAD59-35B1-4DBC-BB6D-1DB246563521}\\x86\\DIFxAPI.dll c:\\documents and settings\\All Users\\Application Data\\{429CAD59-35B1-4DBC-BB6D-1DB246563521}\\x86\\DifXInstall32.exe c:\\documents and settings\\All Users\\Application Data\\{429CAD59-35B1-4DBC-BB6D-1DB246563521}\\x86\\DIFxInstallLog.txt c:\\documents and settings\\All Users\\Application Data\\{429CAD59-35B1-4DBC-BB6D-1DB246563521}\\x86\\GEARAspiWDM.inf c:\\documents and settings\\All Users\\Application Data\\{429CAD59-35B1-4DBC-BB6D-1DB246563521}\\x86\\gearaspiwdmx86.cat c:\\documents and settings\\All Users\\Application Data\\{429CAD59-35B1-4DBC-BB6D-1DB246563521}\\x86\\x86\\GEARAspi.dll c:\\documents and settings\\All Users\\Application Data\\{429CAD59-35B1-4DBC-BB6D-1DB246563521}\\x86\\x86\\GEARAspiWDM.sys . (((((((((((((((((((((((((   Files Created from 2010-09-06 to 2010-10-06  ))))))))))))))))))))))))))))))) . 2010-10-05 14:24 . 2010-10-05 14:24\t161296\t----a-w-\tc:\\windows\\system32\\drivers\\tmcomm.sys 2010-09-28 21:51 . 2010-09-28 21:51\t128532\t---ha-w-\tc:\\windows\\system32\\mlfcache.dat 2010-09-28 21:26 . 2010-09-28 21:26\t--------\td-----w-\tc:\\program files\\iPod 2010-09-28 21:26 . 2010-09-28 21:27\t--------\td-----w-\tc:\\program files\\iTunes 2010-09-28 21:19 . 2010-09-28 21:19\t--------\td-----w-\tc:\\program files\\Apple Software Update 2010-09-24 07:51 . 2010-09-24 07:51\t73000\t----a-w-\tc:\\documents and settings\\All Users\\Application Data\\Apple Computer\\Installer Cache\\iTunes 10.0.1.22\\SetupAdmin.exe 2010-09-16 23:07 . 2010-09-16 23:07\t--------\td-----w-\tc:\\documents and settings\\LocalService\\Local Settings\\Application Data\\HP 2010-09-16 23:04 . 2010-09-16 23:04\t--------\td-----w-\tc:\\documents and settings\\All Users\\Application Data\\Sonic 2010-09-16 23:04 . 2010-09-16 23:04\t--------\td-----w-\tc:\\program files\\Common Files\\Sonic Shared 2010-09-16 22:31 . 2010-09-16 23:06\t76536\t----a-w-\tc:\\windows\\hpgins07.dat 2010-09-16 22:31 . 2005-05-25 06:51\t848\t------w-\tc:\\windows\\hpgmdl07.dat 2010-09-06 18:03 . 2010-08-30 19:34\t1496064\t----a-w-\tc:\\documents and settings\\Owner\\Application Data\\Mozilla\\Firefox\\Profiles\\y6p002qo.default\\extensions\\{3112ca9c-de6d-4884-a869-9855de68056c}\\components\\frozen.dll 2010-09-06 18:03 . 2010-08-30 19:33\t43008\t----a-w-\tc:\\documents and settings\\Owner\\Application Data\\Mozilla\\Firefox\\Profiles\\y6p002qo.default\\extensions\\{3112ca9c-de6d-4884-a869-9855de68056c}\\components\\googletoolbarloader.dll 2010-09-06 18:03 . 2010-08-30 19:33\t338944\t----a-w-\tc:\\documents and settings\\Owner\\Application Data\\Mozilla\\Firefox\\Profiles\\y6p002qo.default\\extensions\\{3112ca9c-de6d-4884-a869-9855de68056c}\\libraries\\googletoolbar-ff2.dll 2010-09-06 18:03 . 2010-08-30 19:33\t346112\t----a-w-\tc:\\documents and settings\\Owner\\Application Data\\Mozilla\\Firefox\\Profiles\\y6p002qo.default\\extensions\\{3112ca9c-de6d-4884-a869-9855de68056c}\\libraries\\googletoolbar-ff3.dll . ((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-10-06 15:28 . 2008-02-07 19:17\t--------\td-----w-\tc:\\documents and settings\\Owner\\Application Data\\WTablet 2010-10-06 15:25 . 2008-02-11 15:58\t--------\td-----w-\tc:\\documents and settings\\LocalService\\Application Data\\WTablet 2010-10-06 02:47 . 2009-06-12 21:26\t--------\td-----w-\tc:\\documents and settings\\Owner\\Application Data\\FileZilla 2010-10-04 22:44 . 2008-09-08 21:50\t--------\td-----w-\tc:\\program files\\Microsoft Silverlight 2010-09-29 15:04 . 2005-11-17 15:25\t184560\t----a-w-\tc:\\documents and settings\\Owner\\Local Settings\\Application Data\\GDIPFONTCACHEV1.DAT 2010-09-28 21:49 . 2005-10-06 00:54\t--------\td-----w-\tc:\\documents and settings\\Owner\\Application Data\\Apple Computer 2010-09-28 21:26 . 2010-03-02 00:37\t--------\td-----w-\tc:\\program files\\Common Files\\Apple 2010-09-28 21:22 . 2006-07-27 00:01\t--------\td-----w-\tc:\\program files\\QuickTime 2010-09-28 21:21 . 2005-10-06 00:51\t--------\td-----w-\tc:\\documents and settings\\All Users\\Application Data\\Apple Computer 2010-09-28 21:16 . 2007-08-03 18:56\t--------\td-----w-\tc:\\program files\\Bonjour 2010-09-28 14:19 . 2009-08-31 16:44\t--------\td-----w-\tc:\\documents and settings\\Owner\\Application Data\\HpUpdate 2010-09-18 16:44 . 2010-07-07 21:45\t--------\td-----w-\tc:\\program files\\WinMerge 2010-09-17 01:59 . 2005-08-04 18:35\t--------\td-----w-\tc:\\program files\\Google 2010-09-16 23:11 . 2009-07-26 02:39\t--------\td-----w-\tc:\\documents and settings\\Owner\\Application Data\\HP 2010-09-16 23:02 . 2009-07-26 00:43\t--------\td-----w-\tc:\\program files\\Common Files\\HP 2010-09-05 16:05 . 2005-11-11 22:14\t--------\td-----w-\tc:\\documents and settings\\Owner\\Application Data\\SmartFTP 2010-08-24 19:20 . 2009-07-26 00:34\t186607\t----a-w-\tc:\\windows\\hpwins23.dat 2010-08-19 21:38 . 2005-03-27 06:01\t--------\td-----w-\tc:\\program files\\Common Files\\Java 2010-08-19 21:33 . 2005-03-27 06:01\t--------\td-----w-\tc:\\program files\\Java 2010-08-17 16:55 . 2009-06-12 21:25\t--------\td-----w-\tc:\\program files\\FileZilla FTP Client 2010-08-06 14:23 . 2010-08-06 14:23\t61440\t----a-w-\tc:\\documents and settings\\Owner\\Application Data\\Sun\\Java\\Deployment\\SystemCache\\6.0\\42\\4488892a-62971399-n\\decora-sse.dll 2010-08-06 14:23 . 2010-08-06 14:23\t503808\t----a-w-\tc:\\documents and settings\\Owner\\Application Data\\Sun\\Java\\Deployment\\SystemCache\\6.0\\4\\7ec4bf04-7b67f1ea-n\\msvcp71.dll 2010-08-06 14:23 . 2010-08-06 14:23\t499712\t----a-w-\tc:\\documents and settings\\Owner\\Application Data\\Sun\\Java\\Deployment\\SystemCache\\6.0\\4\\7ec4bf04-7b67f1ea-n\\jmc.dll 2010-08-06 14:23 . 2010-08-06 14:23\t348160\t----a-w-\tc:\\documents and settings\\Owner\\Application Data\\Sun\\Java\\Deployment\\SystemCache\\6.0\\4\\7ec4bf04-7b67f1ea-n\\msvcr71.dll 2010-08-06 14:23 . 2010-08-06 14:23\t12800\t----a-w-\tc:\\documents and settings\\Owner\\Application Data\\Sun\\Java\\Deployment\\SystemCache\\6.0\\42\\4488892a-62971399-n\\decora-d3d.dll 2010-07-27 23:44 . 2010-07-27 23:44\t91424\t----a-w-\tc:\\windows\\system32\\dnssd.dll 2010-07-27 23:44 . 2010-07-27 23:44\t75040\t----a-w-\tc:\\windows\\system32\\jdns_sd.dll 2010-07-27 23:44 . 2010-07-27 23:44\t197920\t----a-w-\tc:\\windows\\system32\\dnssdX.dll 2010-07-27 23:44 . 2010-07-27 23:44\t107808\t----a-w-\tc:\\windows\\system32\\dns-sd.exe 2010-07-18 14:39 . 2010-07-18 14:30\t16304\t----a-w-\tc:\\windows\\system32\\Wacom_Tablet.dat 2010-07-17 10:00 . 2010-04-22 00:43\t423656\t----a-w-\tc:\\windows\\system32\\deployJava1.dll 2010-02-22 03:15 . 2006-11-02 14:12\t16946\t----a-w-\tc:\\program files\\PANTONEcolorbridge.log . (((((((((((((((((((((((((((((((((((((   Reg Loading Points   )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries &amp; legit default entries are not shown  REGEDIT4 [HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Toolbar\\Webbrowser] \"{BDE1999F-C91A-4F5D-8E3F-B7BB7624DCE8}\"= \"c:\\program files\\100% Free Gin Toolbar\\v2.0.0.2\\100%_Free_Gin_Toolbar.dll\" [2005-10-30 491520] [HKEY_CLASSES_ROOT\\clsid\\{bde1999f-c91a-4f5d-8e3f-b7bb7624dce8}] [HKEY_CLASSES_ROOT\\ToolBar.ToolBarObj.1] [HKEY_CLASSES_ROOT\\TypeLib\\{6E7786E8-7988-4487-B7D0-0AB4268E1A4A}] [HKEY_CLASSES_ROOT\\ToolBar.ToolBarObj] [HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run] \"Creative Detector\"=\"c:\\program files\\Creative\\MediaSource\\Detector\\CTDetect.exe\" [2004-12-03 102400] \"swg\"=\"c:\\program files\\Google\\GoogleToolbarNotifier\\GoogleToolbarNotifier.exe\" [2007-07-02 68856] \"Google Update\"=\"c:\\documents and settings\\Owner\\Local Settings\\Application Data\\Google\\Update\\GoogleUpdate.exe\" [2009-01-15 133104] [HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run] \"NeroFilterCheck\"=\"c:\\windows\\system32\\NeroCheck.exe\" [2001-07-09 155648] \"SynTPLpr\"=\"c:\\program files\\Synaptics\\SynTP\\SynTPLpr.exe\" [2004-11-04 98394] \"SynTPEnh\"=\"c:\\program files\\Synaptics\\SynTP\\SynTPEnh.exe\" [2004-11-04 688218] \"Recguard\"=\"c:\\windows\\SMINST\\RECGUARD.EXE\" [2002-09-14 212992] \"ATIPTA\"=\"c:\\program files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe\" [2005-02-02 339968] \"HPDJ Taskbar Utility\"=\"c:\\windows\\system32\\spool\\drivers\\w32x86\\3\\hpztsb08.exe\" [2003-03-26 172032] \"EPSON Stylus CX4200 Series\"=\"c:\\windows\\System32\\spool\\DRIVERS\\W32X86\\3\\E_FATIAEA.EXE\" [2005-03-08 98304] \"Windows Defender\"=\"c:\\program files\\Windows Defender\\MSASCui.exe\" [2006-11-04 866584] \"CTDVDDET\"=\"c:\\program files\\Creative\\Sound Blaster Audigy 2\\DVDAudio\\CTDVDDET.EXE\" [2003-06-18 45056] \"CTSysVol\"=\"c:\\program files\\Creative\\Sound Blaster Audigy 2\\Surround Mixer\\CTSysVol.exe\" [2005-09-15 57344] \"CTPCMCIASBUtility\"=\"c:\\program files\\Creative\\Sound Blaster Audigy 2\\PCMCIA Sound Blaster Utility\\CTSBUtl.exe\" [2005-09-05 147456] \"AudioDrvEmulator\"=\"c:\\program files\\Creative\\Shared Files\\Module Loader\\DLLML.exe\" [2005-06-17 49152] \"CTHelper\"=\"CTHELPER.EXE\" [2005-08-29 16384] \"Acrobat Assistant 8.0\"=\"c:\\program files\\Adobe\\Acrobat 8.0\\Acrobat\\Acrotray.exe\" [2010-06-16 624056] \"LifeCam\"=\"c:\\program files\\Microsoft LifeCam\\LifeExp.exe\" [2007-05-17 279912] \"TrueImageMonitor.exe\"=\"c:\\program files\\Acronis\\TrueImageHome\\TrueImageMonitor.exe\" [2008-11-22 4352832] \"AcronisTimounterMonitor\"=\"c:\\program files\\Acronis\\TrueImageHome\\TimounterMonitor.exe\" [2008-11-22 960528] \"Acronis Scheduler2 Service\"=\"c:\\program files\\Common Files\\Acronis\\Schedule2\\schedhlp.exe\" [2008-11-22 165144] \"HP Software Update\"=\"c:\\program files\\HP\\HP Software Update\\HPWuSchd2.exe\" [2010-03-12 49208] \"Adobe Reader Speed Launcher\"=\"c:\\program files\\Adobe\\Reader 9.0\\Reader\\Reader_sl.exe\" [2009-12-22 35760] \"Adobe ARM\"=\"c:\\program files\\Common Files\\Adobe\\ARM\\1.0\\AdobeARM.exe\" [2010-06-09 976832] \"SunJavaUpdateSched\"=\"c:\\program files\\Common Files\\Java\\Java Update\\jusched.exe\" [2010-05-14 248552] \"QuickTime Task\"=\"c:\\program files\\QuickTime\\QTTask.exe\" [2010-09-08 421888] \"iTunesHelper\"=\"c:\\program files\\iTunes\\iTunesHelper.exe\" [2010-09-24 421160] c:\\documents and settings\\All Users\\Start Menu\\Programs\\Startup\\ HP Digital Imaging Monitor.lnk - c:\\program files\\HP\\Digital Imaging\\bin\\hpqtra08.exe [2008-10-16 214360] HP Image Zone Fast Start.lnk - c:\\program files\\HP\\Digital Imaging\\bin\\hpqthb08.exe [2005-5-12 73728] KODAK Software Updater.lnk - c:\\program files\\Kodak\\KODAK Software Updater\\7288971\\Program\\Kodak Software Updater.exe [2004-2-13 16423] Spyder3Utility.lnk - c:\\program files\\Datacolor\\Spyder3Pro\\Utility\\Spyder3Utility.exe [2008-3-19 6333954] [hkey_local_machine\\software\\microsoft\\windows\\currentversion\\explorer\\ShellExecuteHooks] \"{EDB0E980-90BD-11D4-8599-0008C7D3B6F8}\"= \"c:\\program files\\Qualcomm\\Eudora\\EuShlExt.dll\" [2005-06-08 86016] [HKEY_LOCAL_MACHINE\\software\\microsoft\\windows nt\\currentversion\\drivers32] \"mixer\"=DrvTrNTm.dll \"wave\"=DrvTrNTm.dll [HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\Minimal\\WinDefend] @=\"Service\" [HKLM\\~\\startupfolder\\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AT&amp;T Self Support Tool.lnk] path=c:\\documents and settings\\All Users\\Start Menu\\Programs\\Startup\\AT&amp;T Self Support Tool.lnk backup=c:\\windows\\pss\\AT&amp;T Self Support Tool.lnkCommon Startup [HKLM\\~\\startupfolder\\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk] path=c:\\documents and settings\\All Users\\Start Menu\\Programs\\Startup\\Kodak EasyShare software.lnk backup=c:\\windows\\pss\\Kodak EasyShare software.lnkCommon Startup [HKLM\\~\\startupfolder\\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ZyXEL G-202 Wireless Adapter Utility.lnk] path=c:\\documents and settings\\All Users\\Start Menu\\Programs\\Startup\\ZyXEL G-202 Wireless Adapter Utility.lnk backup=c:\\windows\\pss\\ZyXEL G-202 Wireless Adapter Utility.lnkCommon Startup [HKEY_LOCAL_MACHINE\\software\\microsoft\\shared tools\\msconfig\\startupreg\\1&amp;1 EasyLogin] 2009-02-12 10:21\t2200576\t----a-w-\tc:\\program files\\1&amp;1\\1&amp;1 EasyLogin\\EasyLogin.exe [HKEY_LOCAL_MACHINE\\software\\microsoft\\shared tools\\msconfig\\startupreg\\CitiVAN] 2004-08-12 19:55\t192512\t----a-w-\tc:\\program files\\Citi Virtual Account Numbers\\CitiVAN.exe [HKEY_LOCAL_MACHINE\\software\\microsoft\\shared tools\\msconfig\\startupreg\\iTunesHelper] 2010-09-24 07:10\t421160\t----a-w-\tc:\\program files\\iTunes\\iTunesHelper.exe [HKEY_LOCAL_MACHINE\\software\\microsoft\\shared tools\\msconfig\\startupreg\\Messenger (Yahoo!)] 2009-03-18 23:50\t4363504\t----a-w-\tc:\\program files\\Yahoo!\\Messenger\\YahooMessenger.exe [HKEY_LOCAL_MACHINE\\software\\microsoft\\shared tools\\msconfig\\startupreg\\Motive SmartBridge] 2005-08-24 13:51\t442455\t----a-w-\tc:\\progra~1\\SBCSEL~1\\SMARTB~1\\MotiveSB.exe [HKEY_LOCAL_MACHINE\\software\\microsoft\\shared tools\\msconfig\\startupreg\\SmileboxTray] 2009-06-08 09:15\t266888\t----a-w-\tc:\\documents and settings\\Owner\\Application Data\\Smilebox\\SmileboxTray.exe [HKEY_LOCAL_MACHINE\\software\\microsoft\\shared tools\\msconfig\\startupreg\\swg] 2007-07-02 16:15\t68856\t----a-w-\tc:\\program files\\Google\\GoogleToolbarNotifier\\GoogleToolbarNotifier.exe [HKEY_LOCAL_MACHINE\\software\\microsoft\\shared tools\\msconfig\\startupreg\\TotalRecorderScheduler] 2006-12-06 02:49\t114688\t----a-w-\tc:\\program files\\HighCriteria\\TotalRecorder\\TotRecSched.exe [HKEY_LOCAL_MACHINE\\software\\microsoft\\security center\\Monitoring] \"DisableMonitoring\"=dword:00000001 [HKEY_LOCAL_MACHINE\\software\\microsoft\\security center\\Monitoring\\SymantecAntiVirus] \"DisableMonitoring\"=dword:00000001 [HKEY_LOCAL_MACHINE\\software\\microsoft\\security center\\Monitoring\\SymantecFirewall] \"DisableMonitoring\"=dword:00000001 [HKLM\\~\\services\\sharedaccess\\parameters\\firewallpolicy\\standardprofile] \"EnableFirewall\"= 0 (0x0) [HKLM\\~\\services\\sharedaccess\\parameters\\firewallpolicy\\standardprofile\\AuthorizedApplications\\List] \"c:\\\\Program Files\\\\SmartFTP\\\\SmartFTP.exe\"= \"c:\\\\WINDOWS\\\\system32\\\\sessmgr.exe\"= \"c:\\\\Program Files\\\\Common Files\\\\Adobe\\\\Adobe Version Cue CS3\\\\Server\\\\bin\\\\VersionCueCS3.exe\"= \"%windir%\\\\Network Diagnostic\\\\xpnetdiag.exe\"= \"c:\\\\Program Files\\\\Kodak\\\\Kodak EasyShare software\\\\bin\\\\EasyShare.exe\"= \"c:\\\\Program Files\\\\HP\\\\Digital Imaging\\\\bin\\\\hpqtra08.exe\"= \"c:\\\\Program Files\\\\HP\\\\Digital Imaging\\\\bin\\\\hpqste08.exe\"= \"c:\\\\Program Files\\\\HP\\\\Digital Imaging\\\\bin\\\\hpofxm08.exe\"= \"c:\\\\Program Files\\\\HP\\\\Digital Imaging\\\\bin\\\\hposfx08.exe\"= \"c:\\\\Program Files\\\\HP\\\\Digital Imaging\\\\bin\\\\hposid01.exe\"= \"c:\\\\Program Files\\\\HP\\\\Digital Imaging\\\\bin\\\\hpqkygrp.exe\"= \"c:\\\\Program Files\\\\HP\\\\Digital Imaging\\\\bin\\\\hpzwiz01.exe\"= \"c:\\program files\\Microsoft ActiveSync\\rapimgr.exe\"= c:\\program files\\Microsoft ActiveSync\\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager \"c:\\program files\\Microsoft ActiveSync\\wcescomm.exe\"= c:\\program files\\Microsoft ActiveSync\\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager \"c:\\program files\\Microsoft ActiveSync\\WCESMgr.exe\"= c:\\program files\\Microsoft ActiveSync\\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application \"c:\\\\Program Files\\\\Microsoft LifeCam\\\\LifeCam.exe\"= \"c:\\\\Program Files\\\\Microsoft LifeCam\\\\LifeExp.exe\"= \"c:\\\\Program Files\\\\Pando Networks\\\\Media Booster\\\\PMB.exe\"= \"c:\\\\Program Files\\\\HP\\\\Digital Imaging\\\\{FA0F0A01-4631-4161-A6C2-948BF694382E}\\\\setup\\\\hpznui01.exe\"= \"c:\\\\Program Files\\\\Bonjour\\\\mDNSResponder.exe\"= \"c:\\\\Program Files\\\\iTunes\\\\iTunes.exe\"= [HKLM\\~\\services\\sharedaccess\\parameters\\firewallpolicy\\standardprofile\\GloballyOpenPorts\\List] \"3389:TCP\"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009 \"3703:TCP\"= 3703:TCP:Adobe Version Cue CS3 Server \"3704:TCP\"= 3704:TCP:Adobe Version Cue CS3 Server \"50900:TCP\"= 50900:TCP:Adobe Version Cue CS3 Server \"50901:TCP\"= 50901:TCP:Adobe Version Cue CS3 Server \"26675:TCP\"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service \"58977:TCP\"= 58977:TCP:Pando Media Booster \"58977:UDP\"= 58977:UDP:Pando Media Booster R0 SymDS;Symantec Data Store;c:\\windows\\system32\\drivers\\NIS\\1108000.005\\symds.sys [9/24/2010 10:05 AM 328752] R0 SymEFA;Symantec Extended File Attributes;c:\\windows\\system32\\drivers\\NIS\\1108000.005\\symefa.sys [9/24/2010 10:05 AM 173104] R1 BHDrvx86;BHDrvx86;c:\\documents and settings\\All Users\\Application Data\\Norton\\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\\NIS_17.0.0.136\\Definitions\\BASHDefs\\20101001.001\\BHDrvx86.sys [10/5/2010 5:14 PM 692272] R1 ccHP;Symantec Hash Provider;c:\\windows\\system32\\drivers\\NIS\\1108000.005\\cchpx86.sys [9/24/2010 10:05 AM 501888] R1 NEOFLTR_540_11529;Juniper Networks TDI Filter Driver (NEOFLTR_540_11529);c:\\windows\\system32\\drivers\\NEOFLTR_540_11529.sys [1/29/2007 8:33 PM 57591] R1 SymIRON;Symantec Iron Driver;c:\\windows\\system32\\drivers\\NIS\\1108000.005\\ironx86.sys [9/24/2010 10:05 AM 116784] R2 NIS;Norton Internet Security;c:\\program files\\Norton Internet Security\\Engine\\17.8.0.5\\ccsvchst.exe [9/24/2010 10:05 AM 126392] R2 TabletServiceWacom;TabletServiceWacom;c:\\windows\\system32\\Wacom_Tablet.exe [12/25/2009 11:12 AM 5010288] R2 WinDefend;Windows Defender;c:\\program files\\Windows Defender\\MsMpEng.exe [11/3/2006 7:19 PM 13592] R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\\program files\\Common Files\\Symantec Shared\\EENGINE\\EraserUtilRebootDrv.sys [5/29/2010 5:56 AM 102448] R3 IDSxpx86;IDSxpx86;c:\\documents and settings\\All Users\\Application Data\\Norton\\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\\NIS_17.0.0.136\\Definitions\\IPSDefs\\20101005.004\\IDSXpx86.sys [10/6/2010 8:24 AM 331640] R3 wacmoumonitor;Wacom Mode Helper;c:\\windows\\system32\\drivers\\wacmoumonitor.sys [6/15/2009 9:19 AM 16168] S2 gupdate;Google Update Service (gupdate);c:\\program files\\Google\\Update\\GoogleUpdate.exe [6/9/2010 10:47 AM 136176] S3 CachemanXPService;CachemanXP;c:\\progra~1\\CACHEM~1\\CachemanXP.exe [12/31/2006 9:48 AM 208384] S3 Dhelfcssn;Dhelfcssn; [x] S3 GTIPCI21;GTIPCI21;c:\\windows\\system32\\drivers\\gtipci21.sys [5/3/2004 7:26 PM 80384] S3 MSHUSBVideo;NX6000/NX3000/VX7000 Filter Driver;c:\\windows\\system32\\drivers\\nx6000.sys [5/3/2009 5:20 PM 34136] S3 PortlUSB;PortlUSB;c:\\windows\\system32\\drivers\\SiriusUSB.sys [5/1/2008 11:18 AM 7552] S3 Spyder3;Datacolor Spyder3;c:\\windows\\system32\\drivers\\Spyder3.sys [3/19/2008 3:26 PM 12288] S3 WDC_SAM;WD SCSI Pass Thru driver;c:\\windows\\system32\\drivers\\wdcsam.sys [4/28/2010 12:50 PM 11520] [HKEY_LOCAL_MACHINE\\software\\microsoft\\windows nt\\currentversion\\svchost] HPZ12\tREG_MULTI_SZ   \tPml Driver HPZ12 Net Driver HPZ12 HPService\tREG_MULTI_SZ   \tHPSLPSVC hpdevmgmt\tREG_MULTI_SZ   \thpqcxs08 hpqddsvc . Contents of the 'Scheduled Tasks' folder 2010-10-06 c:\\windows\\Tasks\\GoogleUpdateTaskMachineCore.job - c:\\program files\\Google\\Update\\GoogleUpdate.exe [2010-06-09 11:00] 2010-10-06 c:\\windows\\Tasks\\GoogleUpdateTaskMachineUA.job - c:\\program files\\Google\\Update\\GoogleUpdate.exe [2010-06-09 11:00] 2010-10-05 c:\\windows\\Tasks\\GoogleUpdateTaskUserS-1-5-21-3923770298-4147761796-204207088-1003Core.job - c:\\documents and settings\\Owner\\Local Settings\\Application Data\\Google\\Update\\GoogleUpdate.exe [2009-01-15 20:34] 2010-10-06 c:\\windows\\Tasks\\GoogleUpdateTaskUserS-1-5-21-3923770298-4147761796-204207088-1003UA.job - c:\\documents and settings\\Owner\\Local Settings\\Application Data\\Google\\Update\\GoogleUpdate.exe [2009-01-15 20:34] 2010-10-06 c:\\windows\\Tasks\\MP Scheduled Scan.job - c:\\program files\\Windows Defender\\MpCmdRun.exe [2006-11-04 00:20] 2010-10-03 c:\\windows\\Tasks\\Norton Internet Security - Owner - Full System Scan.job - c:\\program files\\Norton Internet Security\\Engine\\17.8.0.5\\navw32.exe [2010-09-24 19:24] . . ------- Supplementary Scan ------- . uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&amp;sourceid=ie7&amp;rls=com.microsoft:en-US&amp;ie=utf8&amp;oe=utf8 uStart Page = hxxp://www.google.com/ mStart Page = hxxp://www.yahoo.com uInternet Connection Wizard,ShellNext = hxxp://www.google.com/ uInternet Settings,ProxyOverride = 127.0.0.1;*.local IE: Append to existing PDF - c:\\program files\\Adobe\\Acrobat 8.0\\Acrobat\\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert link target to Adobe PDF - c:\\program files\\Adobe\\Acrobat 8.0\\Acrobat\\AcroIEFavClient.dll/AcroIECapture.html IE: Convert link target to existing PDF - c:\\program files\\Adobe\\Acrobat 8.0\\Acrobat\\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert selected links to Adobe PDF - c:\\program files\\Adobe\\Acrobat 8.0\\Acrobat\\AcroIEFavClient.dll/AcroIECaptureSelLinks.html IE: Convert selected links to existing PDF - c:\\program files\\Adobe\\Acrobat 8.0\\Acrobat\\AcroIEFavClient.dll/AcroIEAppendSelLinks.html IE: Convert selection to Adobe PDF - c:\\program files\\Adobe\\Acrobat 8.0\\Acrobat\\AcroIEFavClient.dll/AcroIECapture.html IE: Convert selection to existing PDF - c:\\program files\\Adobe\\Acrobat 8.0\\Acrobat\\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert to Adobe PDF - c:\\program files\\Adobe\\Acrobat 8.0\\Acrobat\\AcroIEFavClient.dll/AcroIECapture.html IE: Google Sidewiki... - c:\\program files\\Google\\Google Toolbar\\Component\\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html IE: {{A453794C-C643-4295-98A5-597CFC8D72EC} - c:\\program files\\Mail This Page\\MailThisPage.exe Trusted Zone: yahoo.com\\games TCP: {31DF49E6-0FC2-48E5-88C4-B5EE26A41961} = 68.94.156.1,68.94.157.1 DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} - hxxp://download.zonelabs.com/bin/promotions/spywaredetector/ICSScanner37350.cab DPF: {BEC2768D-297F-4A58-B004-DC0637A60F88} - hxxp://uwhbld-straweb.uwhis.hosp.wisc.edu/stratacap7/SCapEC7.CAB FF - ProfilePath - c:\\documents and settings\\Owner\\Application Data\\Mozilla\\Firefox\\Profiles\\y6p002qo.default\\ FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&amp;ie=UTF-8&amp;oe=UTF-8&amp;q= FF - prefs.js: browser.search.selectedEngine - Yahoo FF - component: c:\\documents and settings\\All Users\\Application Data\\Norton\\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\\NIS_17.0.0.136\\coFFPlgn\\components\\coFFPlgn.dll FF - component: c:\\documents and settings\\All Users\\Application Data\\Norton\\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\\NIS_17.0.0.136\\IPSFFPlgn\\components\\IPSFFPl.dll FF - component: c:\\documents and settings\\Owner\\Application Data\\Mozilla\\Firefox\\Profiles\\y6p002qo.default\\extensions\\{3112ca9c-de6d-4884-a869-9855de68056c}\\components\\frozen.dll FF - component: c:\\documents and settings\\Owner\\Application Data\\Mozilla\\Firefox\\Profiles\\y6p002qo.default\\extensions\\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\\platform\\WINNT_x86-msvc\\components\\ipc_fireftp.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\\windows\\Microsoft.NET\\Framework\\v3.5\\Windows Presentation Foundation\\DotNetAssistantExtension\\ ---- FIREFOX POLICIES ---- c:\\program files\\Mozilla Firefox\\greprefs\\all.js - pref(\"network.IDN.whitelist.xn--mgbaam7a8h\", true);  c:\\program files\\Mozilla Firefox\\greprefs\\all.js - pref(\"network.IDN.whitelist.xn--mgberp4a5d4ar\", true);  c:\\program files\\Mozilla Firefox\\defaults\\pref\\firefox.js - pref(\"dom.ipc.plugins.enabled\", false); . [HKEY_LOCAL_MACHINE\\System\\ControlSet001\\Services\\NIS] \"ImagePath\"=\"\\\"c:\\program files\\Norton Internet Security\\Engine\\17.8.0.5\\ccSvcHst.exe\\\" /s \\\"NIS\\\" /m \\\"c:\\program files\\Norton Internet Security\\Engine\\17.8.0.5\\diMaster.dll\\\" /prefetch:1\" . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - &gt; 'winlogon.exe'(724) c:\\windows\\system32\\Ati2evxx.dll . Completion time: 2010-10-06  11:04:04 ComboFix-quarantined-files.txt  2010-10-06 16:04 ComboFix2.txt  2010-10-06 14:45 Pre-Run: 18,035,695,616 bytes free Post-Run: 17,997,320,192 bytes free - - End Of File - - A16991D09D223472A6BA0AAE6D87C8FE ======================================================== NEW HIJACKTHIS LOG Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 11:08:30 AM, on 10/6/2010 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.17055) Boot mode: Normal Running processes: C:\\WINDOWS\\System32\\smss.exe C:\\WINDOWS\\system32\\winlogon.exe C:\\WINDOWS\\system32\\services.exe C:\\WINDOWS\\system32\\lsass.exe C:\\WINDOWS\\system32\\Ati2evxx.exe C:\\WINDOWS\\system32\\svchost.exe C:\\Program Files\\Windows Defender\\MsMpEng.exe C:\\WINDOWS\\System32\\svchost.exe C:\\WINDOWS\\system32\\spoolsv.exe C:\\Program Files\\Common Files\\Acronis\\Schedule2\\schedul2.exe C:\\Program Files\\Bonjour\\mDNSResponder.exe C:\\WINDOWS\\system32\\CTsvcCDA.EXE C:\\WINDOWS\\system32\\svchost.exe C:\\WINDOWS\\system32\\svchost.exe C:\\Program Files\\Java\\jre6\\bin\\jqs.exe C:\\Program Files\\Microsoft LifeCam\\MSCamS32.exe C:\\WINDOWS\\System32\\svchost.exe C:\\Program Files\\Norton Internet Security\\Engine\\17.8.0.5\\ccSvcHst.exe C:\\WINDOWS\\System32\\svchost.exe C:\\Program Files\\Common Files\\New Boundary\\PrismXL\\PRISMXL.SYS C:\\WINDOWS\\system32\\svchost.exe C:\\Program Files\\Smith Micro\\StuffIt11\\ArcNameService.exe C:\\WINDOWS\\system32\\Wacom_Tablet.exe C:\\Program Files\\Yahoo!\\SoftwareUpdate\\YahooAUService.exe C:\\Program Files\\Norton Internet Security\\Engine\\17.8.0.5\\ccSvcHst.exe C:\\WINDOWS\\system32\\Ati2evxx.exe C:\\WINDOWS\\system32\\Wacom_Tablet.exe C:\\Program Files\\Synaptics\\SynTP\\SynTPLpr.exe C:\\Program Files\\Synaptics\\SynTP\\SynTPEnh.exe C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe C:\\Program Files\\Windows Defender\\MSASCui.exe C:\\Program Files\\Creative\\Sound Blaster Audigy 2\\Surround Mixer\\CTSysVol.exe C:\\Program Files\\Creative\\Shared Files\\Module Loader\\DLLML.exe C:\\Program Files\\Adobe\\Acrobat 8.0\\Acrobat\\Acrotray.exe C:\\Program Files\\Acronis\\TrueImageHome\\TrueImageMonitor.exe C:\\Program Files\\Acronis\\TrueImageHome\\TimounterMonitor.exe C:\\Program Files\\Common Files\\Acronis\\Schedule2\\schedhlp.exe C:\\Program Files\\HP\\HP Software Update\\HPWuSchd2.exe C:\\Program Files\\Common Files\\Java\\Java Update\\jusched.exe C:\\Program Files\\QuickTime\\QTTask.exe C:\\Program Files\\Creative\\MediaSource\\Detector\\CTDetect.exe C:\\Program Files\\Google\\GoogleToolbarNotifier\\GoogleToolbarNotifier.exe C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe C:\\Program Files\\Datacolor\\Spyder3Pro\\Utility\\Spyder3Utility.exe C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqimzone.exe C:\\Program Files\\Common Files\\Macrovision Shared\\FLEXnet Publisher\\FNPLicensingService.exe C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqSTE08.exe C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqbam08.exe C:\\Program Files\\Common Files\\Apple\\Mobile Device Support\\AppleMobileDeviceService.exe C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgpc01.exe C:\\WINDOWS\\explorer.exe C:\\WINDOWS\\system32\\wscntfy.exe C:\\Documents and Settings\\Owner\\Desktop\\HijackThis.exe R1 - HKLM\\Software\\Microsoft\\Internet Explorer\\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\\Software\\Microsoft\\Internet Explorer\\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\\Software\\Microsoft\\Internet Explorer\\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\\Software\\Microsoft\\Internet Explorer\\Main,Start Page = http://www.yahoo.com R1 - HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings,ProxyOverride = 127.0.0.1;*.local N3 - Netscape 7: # Mozilla User Preferences // This is a generated file! user_pref(\"browser.activation.checkedNNFlag\", true); user_pref(\"browser.bookmarks.added_static_root\", true); user_pref(\"browser.cache.disk.parent_directory\", \"C:\\\\Documents and Settings\\\\Owner\\\\Application Data\\\\Mozilla\\\\Profiles\\\\default\\\\at737ynz.slt\"); user_pref(\"browser.download.dir\", \"C:\\\\Documents and Settings\\\\Owner\\\\Desktop\"); user_pref(\"browser.history.last_page_visited\", \"http://netscape.aol.com/\"); user_pref(\"browser.search.defaultengine\", \"engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src\"); user_pref(\"browser.startup.homepage\", \"http://home.netscape.com/bookmark/7_0/home.html\"); user_pref(\"browser.startup.homepage_override.mstone\", \"rv:1.0.2\"); user_pref(\"browser.tabs.forceHide\", true); user_pref(\"browser.toolbars.showbutton.AimPT\", false); user_pref(\"browser.turbo.showDialog\", true); user_pref(\"editor.default_background_image\", \"\"); user_pref(\"intl.charsetmenu.browser.cache\", \"us-ascii, w N3 - Netscape 7: # Mozilla User Preferences // This is a generated file! user_pref(\"browser.activation.checkedNNFlag\", true); user_pref(\"browser.bookmarks.added_static_root\", true); user_pref(\"browser.cache.disk.parent_directory\", \"C:\\\\Documents and Settings\\\\Owner\\\\Application Data\\\\Mozilla\\\\Profiles\\\\default\\\\at737ynz.slt\"); user_pref(\"browser.download.dir\", \"C:\\\\Documents and Settings\\\\Owner\\\\Desktop\"); user_pref(\"browser.history.last_page_visited\", \"http://netscape.aol.com/\"); user_pref(\"browser.search.defaultengine\", \"engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src\"); user_pref(\"browser.startup.homepage\", \"http://home.netscape.com/bookmark/7_0/home.html\"); user_pref(\"browser.startup.homepage_override.mstone\", \"rv:1.0.2\"); user_pref(\"browser.tabs.forceHide\", true); user_pref(\"browser.toolbars.showbutton.AimPT\", false); user_pref(\"browser.turbo.showDialog\", true); user_pref(\"editor.default_background_image\", \"\"); user_pref(\"intl.charsetmenu.browser.cache\", \"us-ascii, w O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\\Program Files\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroIEHelperShim.dll O2 - BHO: YSPManager - {25BC7718-0BFA-40EA-B381-4B2D9732D686} - C:\\Program Files\\Yahoo!\\Search Protection\\ysp.dll O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\\Program Files\\Norton Internet Security\\Engine\\17.8.0.5\\coIEPlg.dll O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\\Program Files\\Norton Internet Security\\Engine\\17.8.0.5\\IPSBHO.DLL O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\\Program Files\\Common Files\\Microsoft Shared\\Windows Live\\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\\Program Files\\Google\\Google Toolbar\\GoogleToolbar_32.dll O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\\Program Files\\Java\\jre6\\bin\\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\\Program Files\\Java\\jre6\\lib\\deploy\\jqs\\ie\\jqs_plugin.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\\Program Files\\Adobe\\Acrobat 8.0\\Acrobat\\AcroIEFavClient.dll O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\\Program Files\\Norton Internet Security\\Engine\\17.8.0.5\\coIEPlg.dll O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\\Program Files\\Google\\Google Toolbar\\GoogleToolbar_32.dll O4 - HKLM\\..\\Run: [NeroFilterCheck] C:\\WINDOWS\\system32\\NeroCheck.exe O4 - HKLM\\..\\Run: [synTPLpr] C:\\Program Files\\Synaptics\\SynTP\\SynTPLpr.exe O4 - HKLM\\..\\Run: [synTPEnh] C:\\Program Files\\Synaptics\\SynTP\\SynTPEnh.exe O4 - HKLM\\..\\Run: [Recguard] %WINDIR%\\SMINST\\RECGUARD.EXE O4 - HKLM\\..\\Run: [ATIPTA] C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe O4 - HKLM\\..\\Run: [HPDJ Taskbar Utility] C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\hpztsb08.exe O4 - HKLM\\..\\Run: [EPSON Stylus CX4200 Series] C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\E_FATIAEA.EXE /P26 \"EPSON Stylus CX4200 Series\" /O5 \"FILE:\" /M \"Stylus CX4200\" O4 - HKLM\\..\\Run: [Windows Defender] \"C:\\Program Files\\Windows Defender\\MSASCui.exe\" -hide O4 - HKLM\\..\\Run: [CTDVDDET] \"C:\\Program Files\\Creative\\Sound Blaster Audigy 2\\DVDAudio\\CTDVDDET.EXE\" O4 - HKLM\\..\\Run: [CTSysVol] C:\\Program Files\\Creative\\Sound Blaster Audigy 2\\Surround Mixer\\CTSysVol.exe /r O4 - HKLM\\..\\Run: [CTPCMCIASBUtility] C:\\Program Files\\Creative\\Sound Blaster Audigy 2\\PCMCIA Sound Blaster Utility\\CTSBUtl.exe O4 - HKLM\\..\\Run: [AudioDrvEmulator] \"C:\\Program Files\\Creative\\Shared Files\\Module Loader\\DLLML.exe\" -1 AudioDrvEmulator \"C:\\Program Files\\Creative\\Shared Files\\Module Loader\\Audio Emulator\\AudDrvEm.dll\" O4 - HKLM\\..\\Run: [CTHelper] CTHELPER.EXE O4 - HKLM\\..\\Run: [Acrobat Assistant 8.0] \"C:\\Program Files\\Adobe\\Acrobat 8.0\\Acrobat\\Acrotray.exe\" O4 - HKLM\\..\\Run: [Adobe_ID0EYTHM] C:\\PROGRA~1\\COMMON~1\\Adobe\\ADOBEV~1\\Server\\bin\\VERSIO~2.EXE O4 - HKLM\\..\\Run: [LifeCam] \"C:\\Program Files\\Microsoft LifeCam\\LifeExp.exe\" O4 - HKLM\\..\\Run: [TrueImageMonitor.exe] C:\\Program Files\\Acronis\\TrueImageHome\\TrueImageMonitor.exe O4 - HKLM\\..\\Run: [AcronisTimounterMonitor] C:\\Program Files\\Acronis\\TrueImageHome\\TimounterMonitor.exe O4 - HKLM\\..\\Run: [Acronis Scheduler2 Service] \"C:\\Program Files\\Common Files\\Acronis\\Schedule2\\schedhlp.exe\" O4 - HKLM\\..\\Run: [HP Software Update] C:\\Program Files\\HP\\HP Software Update\\HPWuSchd2.exe O4 - HKLM\\..\\Run: [Adobe Reader Speed Launcher] \"C:\\Program Files\\Adobe\\Reader 9.0\\Reader\\Reader_sl.exe\" O4 - HKLM\\..\\Run: [Adobe ARM] \"C:\\Program Files\\Common Files\\Adobe\\ARM\\1.0\\AdobeARM.exe\" O4 - HKLM\\..\\Run: [sunJavaUpdateSched] \"C:\\Program Files\\Common Files\\Java\\Java Update\\jusched.exe\" O4 - HKLM\\..\\Run: [QuickTime Task] \"C:\\Program Files\\QuickTime\\QTTask.exe\" -atboottime O4 - HKLM\\..\\Run: [iTunesHelper] \"C:\\Program Files\\iTunes\\iTunesHelper.exe\" O4 - HKCU\\..\\Run: [Creative Detector] \"C:\\Program Files\\Creative\\MediaSource\\Detector\\CTDetect.exe\" /R O4 - HKCU\\..\\Run: [swg] \"C:\\Program Files\\Google\\GoogleToolbarNotifier\\GoogleToolbarNotifier.exe\" O4 - HKCU\\..\\Run: [Google Update] \"C:\\Documents and Settings\\Owner\\Local Settings\\Application Data\\Google\\Update\\GoogleUpdate.exe\" /c O4 - HKCU\\..\\Run: [H/PC Connection Agent] \"C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe\" O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqthb08.exe O4 - Global Startup: KODAK Software Updater.lnk = C:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\Kodak Software Updater.exe O4 - Global Startup: Spyder3Utility.lnk = C:\\Program Files\\Datacolor\\Spyder3Pro\\Utility\\Spyder3Utility.exe O4 - Global Startup: WFPUser.lnk = C:\\Program Files\\Microsoft Windows Feedback Panel\\wfpuser.exe O4 - Global Startup: WinZip Quick Pick.lnk = C:\\Program Files\\WinZip\\WZQKPICK.EXE O6 - HKCU\\Software\\Policies\\Microsoft\\Internet Explorer\\Toolbars\\Restrictions present O8 - Extra context menu item: Append to existing PDF - res://C:\\Program Files\\Adobe\\Acrobat 8.0\\Acrobat\\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\\Program Files\\Adobe\\Acrobat 8.0\\Acrobat\\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert link target to existing PDF - res://C:\\Program Files\\Adobe\\Acrobat 8.0\\Acrobat\\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\\Program Files\\Adobe\\Acrobat 8.0\\Acrobat\\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\\Program Files\\Adobe\\Acrobat 8.0\\Acrobat\\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\\Program Files\\Adobe\\Acrobat 8.0\\Acrobat\\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert selection to existing PDF - res://C:\\Program Files\\Adobe\\Acrobat 8.0\\Acrobat\\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert to Adobe PDF - res://C:\\Program Files\\Adobe\\Acrobat 8.0\\Acrobat\\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Google Sidewiki... - res://C:\\Program Files\\Google\\Google Toolbar\\Component\\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\\PROGRA~1\\MI3AA1~1\\INetRepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\\PROGRA~1\\MI3AA1~1\\INetRepl.dll O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\\PROGRA~1\\MI3AA1~1\\INetRepl.dll O9 - Extra button: Citi - {4C730913-3961-439b-83D5-F4E445520422} - C:\\Program Files\\Citi Virtual Account Numbers\\CitiVAN.exe O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\\Program Files\\Yahoo!\\Common\\yiesrvc.dll O9 - Extra button: Mail This Page! - {A453794C-C643-4295-98A5-597CFC8D72EC} - C:\\Program Files\\Mail This Page\\MailThisPage.exe O9 - Extra 'Tools' menuitem: Mail This Page! - {A453794C-C643-4295-98A5-597CFC8D72EC} - C:\\Program Files\\Mail This Page\\MailThisPage.exe O9 - Extra button: (no name) - {BBF74FB9-ABCD-4678-880A-2511DAABB5E1} - C:\\Program Files\\Yahoo!\\Search Protection\\ysp.dll O9 - Extra 'Tools' menuitem: Yahoo! Search Protection - {BBF74FB9-ABCD-4678-880A-2511DAABB5E1} - C:\\Program Files\\Yahoo!\\Search Protection\\ysp.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\\WINDOWS\\system32\\Shdocvw.dll O9 - Extra button: HP Smart Select - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\\Program Files\\HP\\Digital Imaging\\Smart Web Printing\\hpswp_BHO.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\\Program Files\\Messenger\\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\\Program Files\\Messenger\\msmsgs.exe O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://support2.charter.com/sdccommon/download/tgctlcm.cab O16 - DPF: {0854D220-A90A-466D-BC02-6683183802B7} (PrintPreview Class) - http://scwmls.fnismls.com/Paragon/Codebase...rintControl.cab O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://support.gateway.com/support/profiler/PCPitStop.CAB O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} - https://www-secure.symantec.com/techsupp/as...rl/LSSupCtl.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\\Program Files\\Yahoo!\\Common\\yinsthelper.dll O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo.walgreens.com/WalgreensActivia.cab O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m...01/mcinsctl.cab O16 - DPF: {4FAE30E1-EE9C-477D-8D06-BF8D3429B60F} (WebIQ Technology Client) - http://webiq001.webiqonline.com/WebIQ/bin/WebIQ.cab O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cab O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1135089869796 O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - http://download.zonelabs.com/bin/promotion...canner37350.cab O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://www1.wkowtv.com/videocam/AxisCamControl.ocx O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab O16 - DPF: {9A57B18E-2F5D-11D5-8997-00104BD12D94} (compid Class) - http://support.gateway.com/support/serialharvest/gwCID.CAB O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/...ro.cab34246.cab O16 - DPF: {BCBC9371-595D-11D4-A96D-00105A1CEF6C} (View22RTE Class) - http://merillat.view22.com/view22/roomapp/View22RTE.cab O16 - DPF: {BEC2768D-297F-4A58-B004-DC0637A60F88} (SCapEC7.ECSession) - http://uwhbld-straweb.uwhis.hosp.wisc.edu/...ap7/SCapEC7.CAB O16 - DPF: {D1D98C0F-A339-42AB-BD5F-EA0FF5D0E65F} (RockYou Image Uploader Control) - http://rockyou.com/RockYouImageUploader.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/get/flash...ent/swflash.cab O16 - DPF: {D670D0B3-05AB-4115-9F87-D983EF1AC747} (AOL Downloader Plugin) - http://pak06.pictures.aol.com/ygp/aol/plug...US.9.1.6.18.cab O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.popcap.com/webgames/popcaploader_v10.cab O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} (JuniperSetup Control) - https://secureaccess.hosp.wisc.edu/dana-cac...uniperSetup.cab O16 - DPF: {F5D98C43-DB16-11CF-8ECA-0000C0FD59C7} (ActiveCGM Control) - http://gis.cityofmadison.com/ACGM_7146/Acgm.cab O17 - HKLM\\System\\CCS\\Services\\Tcpip\\..\\{31DF49E6-0FC2-48E5-88C4-B5EE26A41961}: NameServer = 68.94.156.1,68.94.157.1 O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\\WINDOWS\\system32\\browseui.dll O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\\WINDOWS\\system32\\browseui.dll O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\\Program Files\\Common Files\\Acronis\\Schedule2\\schedul2.exe O23 - Service: Adobe Version Cue CS3 - Adobe Systems Incorporated - C:\\Program Files\\Common Files\\Adobe\\Adobe Version Cue CS3\\Server\\bin\\VersionCueCS3.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\\Program Files\\Common Files\\Apple\\Mobile Device Support\\AppleMobileDeviceService.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\\WINDOWS\\system32\\Ati2evxx.exe O23 - Service: Bonjour Service - Apple Inc. - C:\\Program Files\\Bonjour\\mDNSResponder.exe O23 - Service: CachemanXP (CachemanXPService) - OuterTechnologies - C:\\PROGRA~1\\CACHEM~1\\CachemanXP.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\\WINDOWS\\system32\\CTsvcCDA.EXE O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\\Program Files\\Common Files\\Macrovision Shared\\FLEXnet Publisher\\FNPLicensingService.exe O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\\Program Files\\Google\\Update\\GoogleUpdate.exe O23 - Service: Google Software Updater (gusvc) - Google - C:\\Program Files\\Google\\Common\\Google Updater\\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\\Program Files\\Common Files\\InstallShield\\Driver\\1050\\Intel 32\\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\\Program Files\\iPod\\bin\\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\\Program Files\\Java\\jre6\\bin\\jqs.exe O23 - Service: Norton Internet Security (NIS) - Symantec Corporation - C:\\Program Files\\Norton Internet Security\\Engine\\17.8.0.5\\ccSvcHst.exe O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\\Program Files\\Common Files\\New Boundary\\PrismXL\\PRISMXL.SYS O23 - Service: Stuffit Archive Name Service - Smith Micro Software, Inc. - C:\\Program Files\\Smith Micro\\StuffIt11\\ArcNameService.exe O23 - Service: TabletServiceWacom - Wacom Technology, Corp. - C:\\WINDOWS\\system32\\Wacom_Tablet.exe O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\\Program Files\\Yahoo!\\SoftwareUpdate\\YahooAUService.exe -- End of file - 20270 bytes "
<https://forums.malwarebytes.com/topic/64228-rootkit-or-am-i-paranoid/>