<https://forums.malwarebytes.com/topic/64228-rootkit-or-am-i-paranoid/#comment-323778>
<http://schema.org/text>
"GooredFix by jpshortstuff (03.07.10.1) Log created at 08:13 on 06/10/2010 (Owner) Firefox version 3.6.10 (en-US) ========== GooredScan ========== ========== GooredLog ========== C:\\Program Files\\Mozilla Firefox\\extensions\\ {972ce4c6-7e08-4474-a285-3208198ce6fd} [00:44 05/04/2009] {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} [15:58 10/06/2009] {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} [14:40 26/08/2009] {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} [03:46 08/12/2009] {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} [00:43 22/04/2010] {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} [21:34 19/08/2010] C:\\Documents and Settings\\Owner\\Application Data\\Mozilla\\Firefox\\Profiles\\y6p002qo.default\\extensions\\ inspector@mozilla.org [13:27 03/09/2010] moveplayer@movenetworks.com [03:35 26/02/2008] sidecar@amazon.com [13:23 10/06/2010] {20a82645-c095-46ed-80e3-08825760534b} [14:26 28/04/2010] {283f22a5-7fd7-4714-a764-693b69dc76e9} [03:26 13/04/2009] {3112ca9c-de6d-4884-a869-9855de68056c} [18:03 06/09/2010] {3205B348-523A-4fac-9BC4-9939CBF583B0} [23:20 27/07/2010] {3c6e1eed-a07e-4c80-9cf3-66ea0bf40b37} [18:22 09/12/2008] {47e5a66c-0e35-11dc-8314-0800200c9a66} [18:24 09/12/2008] {635abd67-4fe9-1b23-4f01-e679fa7484c1} [17:48 15/04/2010] {73a6fe31-595d-460b-a920-fcc0f8843232} [02:00 05/10/2010] {a7c6cf7f-112c-4500-a7ea-39801a327e5f} [13:22 10/06/2010] {a95d8332-e4b4-6e7f-98ac-20b733364387} [03:53 05/04/2010] {b9db16a4-6edc-47ec-a1f4-b86292ed211d} [23:19 27/07/2010] {c45c406e-ab73-11d8-be73-000a95be3b12} [12:38 03/07/2009] [HKEY_LOCAL_MACHINE\\Software\\Mozilla\\Firefox\\Extensions] \"smartwebprinting@hp.com\"=\"C:\\Program Files\\HP\\Digital Imaging\\Smart Web Printing\\MozillaAddOn2\" [02:08 26/07/2009] \"{20a82645-c095-46ed-80e3-08825760534b}\"=\"C:\\WINDOWS\\Microsoft.NET\\Framework\\v3.5\\Windows Presentation Foundation\\DotNetAssistantExtension\\\" [00:58 09/08/2009] \"{BBDA0591-3099-440a-AA10-41764D9DB4DB}\"=\"C:\\Documents and Settings\\All Users\\Application Data\\Norton\\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\\NIS_17.0.0.136\\IPSFFPlgn\\\" [17:19 19/09/2009] \"{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}\"=\"C:\\Documents and Settings\\All Users\\Application Data\\Norton\\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\\NIS_17.0.0.136\\coFFPlgn\\\" [17:19 19/09/2009] \"jqs@sun.com\"=\"C:\\Program Files\\Java\\jre6\\lib\\deploy\\jqs\\ff\" [20:41 15/01/2009] -=E.O.F=- ================================================================================ = HIJACKTHIS (new) Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 8:15:08 AM, on 10/6/2010 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.17055) Boot mode: Normal Running processes: C:\\WINDOWS\\System32\\smss.exe C:\\WINDOWS\\system32\\winlogon.exe C:\\WINDOWS\\system32\\services.exe C:\\WINDOWS\\system32\\lsass.exe C:\\WINDOWS\\system32\\Ati2evxx.exe C:\\WINDOWS\\system32\\svchost.exe C:\\Program Files\\Windows Defender\\MsMpEng.exe C:\\WINDOWS\\System32\\svchost.exe C:\\WINDOWS\\system32\\spoolsv.exe C:\\Program Files\\Common Files\\Acronis\\Schedule2\\schedul2.exe C:\\Program Files\\Common Files\\Apple\\Mobile Device Support\\AppleMobileDeviceService.exe C:\\Program Files\\Bonjour\\mDNSResponder.exe C:\\WINDOWS\\system32\\CTsvcCDA.EXE C:\\WINDOWS\\system32\\svchost.exe C:\\WINDOWS\\system32\\svchost.exe C:\\Program Files\\Java\\jre6\\bin\\jqs.exe C:\\Program Files\\Microsoft LifeCam\\MSCamS32.exe C:\\Program Files\\Norton Internet Security\\Engine\\17.8.0.5\\ccSvcHst.exe C:\\WINDOWS\\system32\\Ati2evxx.exe C:\\Program Files\\Common Files\\New Boundary\\PrismXL\\PRISMXL.SYS C:\\WINDOWS\\Explorer.EXE C:\\WINDOWS\\system32\\svchost.exe C:\\Program Files\\Smith Micro\\StuffIt11\\ArcNameService.exe C:\\WINDOWS\\system32\\Wacom_Tablet.exe C:\\Program Files\\Yahoo!\\SoftwareUpdate\\YahooAUService.exe C:\\WINDOWS\\system32\\Wacom_Tablet.exe C:\\Program Files\\Synaptics\\SynTP\\SynTPLpr.exe C:\\Program Files\\Synaptics\\SynTP\\SynTPEnh.exe C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe C:\\Program Files\\Windows Defender\\MSASCui.exe C:\\Program Files\\Creative\\Sound Blaster Audigy 2\\DVDAudio\\CTDVDDET.EXE C:\\Program Files\\Creative\\Sound Blaster Audigy 2\\Surround Mixer\\CTSysVol.exe C:\\Program Files\\Norton Internet Security\\Engine\\17.8.0.5\\ccSvcHst.exe C:\\Program Files\\Creative\\Sound Blaster Audigy 2\\PCMCIA Sound Blaster Utility\\CTSBUtl.exe C:\\Program Files\\Creative\\Shared Files\\Module Loader\\DLLML.exe C:\\WINDOWS\\CTHELPER.EXE C:\\Program Files\\Adobe\\Acrobat 8.0\\Acrobat\\Acrotray.exe C:\\Program Files\\Acronis\\TrueImageHome\\TrueImageMonitor.exe C:\\Program Files\\Acronis\\TrueImageHome\\TimounterMonitor.exe C:\\Program Files\\Common Files\\Acronis\\Schedule2\\schedhlp.exe C:\\Program Files\\HP\\HP Software Update\\HPWuSchd2.exe C:\\Program Files\\Common Files\\Java\\Java Update\\jusched.exe C:\\Program Files\\iTunes\\iTunesHelper.exe C:\\Program Files\\Creative\\MediaSource\\Detector\\CTDetect.exe C:\\Program Files\\Google\\GoogleToolbarNotifier\\GoogleToolbarNotifier.exe C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe C:\\WINDOWS\\system32\\ctfmon.exe C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe C:\\PROGRA~1\\MI3AA1~1\\rapimgr.exe C:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\Kodak Software Updater.exe C:\\Program Files\\Datacolor\\Spyder3Pro\\Utility\\Spyder3Utility.exe C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqimzone.exe C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqSTE08.exe C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqbam08.exe C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgpc01.exe C:\\Program Files\\iPod\\bin\\iPodService.exe C:\\Program Files\\Common Files\\Macrovision Shared\\FLEXnet Publisher\\FNPLicensingService.exe C:\\WINDOWS\\system32\\notepad.exe C:\\Documents and Settings\\Owner\\Local Settings\\Application Data\\Google\\Chrome\\Application\\chrome.exe C:\\Documents and Settings\\Owner\\Local Settings\\Application Data\\Google\\Chrome\\Application\\chrome.exe C:\\Documents and Settings\\Owner\\Local Settings\\Application Data\\Google\\Chrome\\Application\\chrome.exe C:\\Documents and Settings\\Owner\\Local Settings\\Application Data\\Google\\Chrome\\Application\\chrome.exe C:\\Documents and Settings\\Owner\\Desktop\\mess\\HijackThis.exe R1 - HKCU\\Software\\Microsoft\\Internet Explorer\\Main,Default_Page_URL = http://www.yahoo.com R0 - HKLM\\Software\\Microsoft\\Internet Explorer\\Main,Start Page = http://www.yahoo.com R1 - HKCU\\Software\\Microsoft\\Internet Explorer\\Main,Window Title = Windows Internet Explorer provided by Yahoo! R1 - HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings,ProxyOverride = 127.0.0.1;*.local N3 - Netscape 7: # Mozilla User Preferences // This is a generated file! user_pref(\"browser.activation.checkedNNFlag\", true); user_pref(\"browser.bookmarks.added_static_root\", true); user_pref(\"browser.cache.disk.parent_directory\", \"C:\\\\Documents and Settings\\\\Owner\\\\Application Data\\\\Mozilla\\\\Profiles\\\\default\\\\at737ynz.slt\"); user_pref(\"browser.download.dir\", \"C:\\\\Documents and Settings\\\\Owner\\\\Desktop\"); user_pref(\"browser.history.last_page_visited\", \"http://netscape.aol.com/\"); user_pref(\"browser.search.defaultengine\", \"engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src\"); user_pref(\"browser.startup.homepage\", \"http://home.netscape.com/bookmark/7_0/home.html\"); user_pref(\"browser.startup.homepage_override.mstone\", \"rv:1.0.2\"); user_pref(\"browser.tabs.forceHide\", true); user_pref(\"browser.toolbars.showbutton.AimPT\", false); user_pref(\"browser.turbo.showDialog\", true); user_pref(\"editor.default_background_image\", \"\"); user_pref(\"intl.charsetmenu.browser.cache\", \"us-ascii, w N3 - Netscape 7: # Mozilla User Preferences // This is a generated file! user_pref(\"browser.activation.checkedNNFlag\", true); user_pref(\"browser.bookmarks.added_static_root\", true); user_pref(\"browser.cache.disk.parent_directory\", \"C:\\\\Documents and Settings\\\\Owner\\\\Application Data\\\\Mozilla\\\\Profiles\\\\default\\\\at737ynz.slt\"); user_pref(\"browser.download.dir\", \"C:\\\\Documents and Settings\\\\Owner\\\\Desktop\"); user_pref(\"browser.history.last_page_visited\", \"http://netscape.aol.com/\"); user_pref(\"browser.search.defaultengine\", \"engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src\"); user_pref(\"browser.startup.homepage\", \"http://home.netscape.com/bookmark/7_0/home.html\"); user_pref(\"browser.startup.homepage_override.mstone\", \"rv:1.0.2\"); user_pref(\"browser.tabs.forceHide\", true); user_pref(\"browser.toolbars.showbutton.AimPT\", false); user_pref(\"browser.turbo.showDialog\", true); user_pref(\"editor.default_background_image\", \"\"); user_pref(\"intl.charsetmenu.browser.cache\", \"us-ascii, w O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\\Program Files\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroIEHelperShim.dll O2 - BHO: YSPManager - {25BC7718-0BFA-40EA-B381-4B2D9732D686} - C:\\Program Files\\Yahoo!\\Search Protection\\ysp.dll O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\\Program Files\\Norton Internet Security\\Engine\\17.8.0.5\\coIEPlg.dll O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\\Program Files\\Norton Internet Security\\Engine\\17.8.0.5\\IPSBHO.DLL O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\\Program Files\\Common Files\\Microsoft Shared\\Windows Live\\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\\Program Files\\Google\\Google Toolbar\\GoogleToolbar_32.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\\Program Files\\Google\\GoogleToolbarNotifier\\5.6.5612.1312\\swg.dll O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\\Program Files\\Java\\jre6\\bin\\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\\Program Files\\Java\\jre6\\lib\\deploy\\jqs\\ie\\jqs_plugin.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\\PROGRA~1\\Yahoo!\\Companion\\Installs\\cpn6\\yt.dll O3 - Toolbar: 100% Free Gin Toolbar - {BDE1999F-C91A-4f5d-8E3F-B7BB7624DCE8} - C:\\Program Files\\100% Free Gin Toolbar\\v2.0.0.2\\100%_Free_Gin_Toolbar.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\\Program Files\\Adobe\\Acrobat 8.0\\Acrobat\\AcroIEFavClient.dll O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\\Program Files\\Norton Internet Security\\Engine\\17.8.0.5\\coIEPlg.dll O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\\Program Files\\Google\\Google Toolbar\\GoogleToolbar_32.dll O4 - HKLM\\..\\Run: [NeroFilterCheck] C:\\WINDOWS\\system32\\NeroCheck.exe O4 - HKLM\\..\\Run: [synTPLpr] C:\\Program Files\\Synaptics\\SynTP\\SynTPLpr.exe O4 - HKLM\\..\\Run: [synTPEnh] C:\\Program Files\\Synaptics\\SynTP\\SynTPEnh.exe O4 - HKLM\\..\\Run: [Recguard] %WINDIR%\\SMINST\\RECGUARD.EXE O4 - HKLM\\..\\Run: [ATIPTA] C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe O4 - HKLM\\..\\Run: [HPDJ Taskbar Utility] C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\hpztsb08.exe O4 - HKLM\\..\\Run: [EPSON Stylus CX4200 Series] C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\E_FATIAEA.EXE /P26 \"EPSON Stylus CX4200 Series\" /O5 \"FILE:\" /M \"Stylus CX4200\" O4 - HKLM\\..\\Run: [Windows Defender] \"C:\\Program Files\\Windows Defender\\MSASCui.exe\" -hide O4 - HKLM\\..\\Run: [CTDVDDET] \"C:\\Program Files\\Creative\\Sound Blaster Audigy 2\\DVDAudio\\CTDVDDET.EXE\" O4 - HKLM\\..\\Run: [CTSysVol] C:\\Program Files\\Creative\\Sound Blaster Audigy 2\\Surround Mixer\\CTSysVol.exe /r O4 - HKLM\\..\\Run: [CTPCMCIASBUtility] C:\\Program Files\\Creative\\Sound Blaster Audigy 2\\PCMCIA Sound Blaster Utility\\CTSBUtl.exe O4 - HKLM\\..\\Run: [AudioDrvEmulator] \"C:\\Program Files\\Creative\\Shared Files\\Module Loader\\DLLML.exe\" -1 AudioDrvEmulator \"C:\\Program Files\\Creative\\Shared Files\\Module Loader\\Audio Emulator\\AudDrvEm.dll\" O4 - HKLM\\..\\Run: [CTHelper] CTHELPER.EXE O4 - HKLM\\..\\Run: [Acrobat Assistant 8.0] \"C:\\Program Files\\Adobe\\Acrobat 8.0\\Acrobat\\Acrotray.exe\" O4 - HKLM\\..\\Run: [Adobe_ID0EYTHM] C:\\PROGRA~1\\COMMON~1\\Adobe\\ADOBEV~1\\Server\\bin\\VERSIO~2.EXE O4 - HKLM\\..\\Run: [WindowsTelemetry] C:\\Program Files\\Microsoft Windows Feedback Panel\\\\WFPUser.exe O4 - HKLM\\..\\Run: [LifeCam] \"C:\\Program Files\\Microsoft LifeCam\\LifeExp.exe\" O4 - HKLM\\..\\Run: [TrueImageMonitor.exe] C:\\Program Files\\Acronis\\TrueImageHome\\TrueImageMonitor.exe O4 - HKLM\\..\\Run: [AcronisTimounterMonitor] C:\\Program Files\\Acronis\\TrueImageHome\\TimounterMonitor.exe O4 - HKLM\\..\\Run: [Acronis Scheduler2 Service] \"C:\\Program Files\\Common Files\\Acronis\\Schedule2\\schedhlp.exe\" O4 - HKLM\\..\\Run: [HP Software Update] C:\\Program Files\\HP\\HP Software Update\\HPWuSchd2.exe O4 - HKLM\\..\\Run: [Adobe Reader Speed Launcher] \"C:\\Program Files\\Adobe\\Reader 9.0\\Reader\\Reader_sl.exe\" O4 - HKLM\\..\\Run: [Adobe ARM] \"C:\\Program Files\\Common Files\\Adobe\\ARM\\1.0\\AdobeARM.exe\" O4 - HKLM\\..\\Run: [sunJavaUpdateSched] \"C:\\Program Files\\Common Files\\Java\\Java Update\\jusched.exe\" O4 - HKLM\\..\\Run: [QuickTime Task] \"C:\\Program Files\\QuickTime\\QTTask.exe\" -atboottime O4 - HKLM\\..\\Run: [iTunesHelper] \"C:\\Program Files\\iTunes\\iTunesHelper.exe\" O4 - HKCU\\..\\Run: [Creative Detector] \"C:\\Program Files\\Creative\\MediaSource\\Detector\\CTDetect.exe\" /R O4 - HKCU\\..\\Run: [updateMgr] C:\\Program Files\\Adobe\\Acrobat 7.0\\Reader\\AdobeUpdateManager.exe AcRdB7_0_9 O4 - HKCU\\..\\Run: [swg] \"C:\\Program Files\\Google\\GoogleToolbarNotifier\\GoogleToolbarNotifier.exe\" O4 - HKCU\\..\\Run: [search Protection] C:\\Program Files\\Yahoo!\\Search Protection\\SearchProtection.exe O4 - HKCU\\..\\Run: [Google Update] \"C:\\Documents and Settings\\Owner\\Local Settings\\Application Data\\Google\\Update\\GoogleUpdate.exe\" /c O4 - HKCU\\..\\Run: [H/PC Connection Agent] \"C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe\" O4 - HKCU\\..\\Run: [ctfmon.exe] C:\\WINDOWS\\system32\\ctfmon.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqthb08.exe O4 - Global Startup: KODAK Software Updater.lnk = C:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\Kodak Software Updater.exe O4 - Global Startup: Spyder3Utility.lnk = C:\\Program Files\\Datacolor\\Spyder3Pro\\Utility\\Spyder3Utility.exe O4 - Global Startup: WFPUser.lnk = C:\\Program Files\\Microsoft Windows Feedback Panel\\wfpuser.exe O4 - Global Startup: WinZip Quick Pick.lnk = C:\\Program Files\\WinZip\\WZQKPICK.EXE O6 - HKCU\\Software\\Policies\\Microsoft\\Internet Explorer\\Restrictions present O6 - HKCU\\Software\\Policies\\Microsoft\\Internet Explorer\\Control Panel present O6 - HKCU\\Software\\Policies\\Microsoft\\Internet Explorer\\Toolbars\\Restrictions present O8 - Extra context menu item: Append to existing PDF - res://C:\\Program Files\\Adobe\\Acrobat 8.0\\Acrobat\\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\\Program Files\\Adobe\\Acrobat 8.0\\Acrobat\\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert link target to existing PDF - res://C:\\Program Files\\Adobe\\Acrobat 8.0\\Acrobat\\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\\Program Files\\Adobe\\Acrobat 8.0\\Acrobat\\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\\Program Files\\Adobe\\Acrobat 8.0\\Acrobat\\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\\Program Files\\Adobe\\Acrobat 8.0\\Acrobat\\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert selection to existing PDF - res://C:\\Program Files\\Adobe\\Acrobat 8.0\\Acrobat\\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert to Adobe PDF - res://C:\\Program Files\\Adobe\\Acrobat 8.0\\Acrobat\\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Google Sidewiki... - res://C:\\Program Files\\Google\\Google Toolbar\\Component\\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\\PROGRA~1\\MI3AA1~1\\INetRepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\\PROGRA~1\\MI3AA1~1\\INetRepl.dll O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\\PROGRA~1\\MI3AA1~1\\INetRepl.dll O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\\Program Files\\Yahoo!\\Common\\yiesrvc.dll O9 - Extra button: Mail This Page! - {A453794C-C643-4295-98A5-597CFC8D72EC} - C:\\Program Files\\Mail This Page\\MailThisPage.exe O9 - Extra 'Tools' menuitem: Mail This Page! - {A453794C-C643-4295-98A5-597CFC8D72EC} - C:\\Program Files\\Mail This Page\\MailThisPage.exe O9 - Extra button: (no name) - {BBF74FB9-ABCD-4678-880A-2511DAABB5E1} - C:\\Program Files\\Yahoo!\\Search Protection\\ysp.dll O9 - Extra 'Tools' menuitem: Yahoo! Search Protection - {BBF74FB9-ABCD-4678-880A-2511DAABB5E1} - C:\\Program Files\\Yahoo!\\Search Protection\\ysp.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\\WINDOWS\\system32\\Shdocvw.dll O9 - Extra button: HP Smart Select - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\\Program Files\\HP\\Digital Imaging\\Smart Web Printing\\hpswp_BHO.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\\Program Files\\Messenger\\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\\Program Files\\Messenger\\msmsgs.exe O9 - Extra button: (no name) - Software - (no file) (HKCU) O9 - Extra button: (no name) - SolidConverterPDF - (no file) (HKCU) O13 - DefaultPrefix:  O15 - Trusted Zone: *.bing.com O15 - Trusted Zone: *.doccentral.com O15 - Trusted Zone: *.fnismls.com O15 - Trusted Zone: *.getmedianow.com O15 - Trusted Zone: *.live.com O15 - Trusted Zone: *.rdesk.com O15 - Trusted Zone: *.rexplorer.net O15 - Trusted Zone: *.safemls.net O15 - Trusted Zone: *.showingtime.com O15 - Trusted Zone: *.sitexdata.com O15 - Trusted Zone: *.spellchecker.net O15 - Trusted Zone: *.transactionpoint.com O15 - Trusted Zone: *.trpoint.com O15 - Trusted Zone: *.xmlsweb.com O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://support2.charter.com/sdccommon/download/tgctlcm.cab O16 - DPF: {0854D220-A90A-466D-BC02-6683183802B7} (PrintPreview Class) - http://scwmls.fnismls.com/Paragon/Codebase...rintControl.cab O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://support.gateway.com/support/profiler/PCPitStop.CAB O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} - https://www-secure.symantec.com/techsupp/as...rl/LSSupCtl.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\\Program Files\\Yahoo!\\Common\\yinsthelper.dll O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo.walgreens.com/WalgreensActivia.cab O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m...01/mcinsctl.cab O16 - DPF: {4FAE30E1-EE9C-477D-8D06-BF8D3429B60F} (WebIQ Technology Client) - http://webiq001.webiqonline.com/WebIQ/bin/WebIQ.cab O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cab O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1135089869796 O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - http://download.zonelabs.com/bin/promotion...canner37350.cab O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://www1.wkowtv.com/videocam/AxisCamControl.ocx O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab O16 - DPF: {9A57B18E-2F5D-11D5-8997-00104BD12D94} (compid Class) - http://support.gateway.com/support/serialharvest/gwCID.CAB O16 - DPF: {A7EA8AD2-287F-11D3-B120-006008C39542} (CBSTIEPrint Class) - http://offers.e-centives.com/cif/download/bin/actxcab.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/...ro.cab34246.cab O16 - DPF: {BCBC9371-595D-11D4-A96D-00105A1CEF6C} (View22RTE Class) - http://merillat.view22.com/view22/roomapp/View22RTE.cab O16 - DPF: {BEC2768D-297F-4A58-B004-DC0637A60F88} (SCapEC7.ECSession) - http://uwhbld-straweb.uwhis.hosp.wisc.edu/...ap7/SCapEC7.CAB O16 - DPF: {D1D98C0F-A339-42AB-BD5F-EA0FF5D0E65F} (RockYou Image Uploader Control) - http://rockyou.com/RockYouImageUploader.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/get/flash...ent/swflash.cab O16 - DPF: {D670D0B3-05AB-4115-9F87-D983EF1AC747} (AOL Downloader Plugin) - http://pak06.pictures.aol.com/ygp/aol/plug...US.9.1.6.18.cab O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.popcap.com/webgames/popcaploader_v10.cab O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} (JuniperSetup Control) - https://secureaccess.hosp.wisc.edu/dana-cac...uniperSetup.cab O16 - DPF: {F5D98C43-DB16-11CF-8ECA-0000C0FD59C7} (ActiveCGM Control) - http://gis.cityofmadison.com/ACGM_7146/Acgm.cab O17 - HKLM\\System\\CCS\\Services\\Tcpip\\..\\{31DF49E6-0FC2-48E5-88C4-B5EE26A41961}: NameServer = 68.94.156.1,68.94.157.1 O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\\WINDOWS\\system32\\browseui.dll O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\\WINDOWS\\system32\\browseui.dll O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\\Program Files\\Common Files\\Acronis\\Schedule2\\schedul2.exe O23 - Service: Adobe Version Cue CS3 - Adobe Systems Incorporated - C:\\Program Files\\Common Files\\Adobe\\Adobe Version Cue CS3\\Server\\bin\\VersionCueCS3.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\\Program Files\\Common Files\\Apple\\Mobile Device Support\\AppleMobileDeviceService.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\\WINDOWS\\system32\\Ati2evxx.exe O23 - Service: Bonjour Service - Apple Inc. - C:\\Program Files\\Bonjour\\mDNSResponder.exe O23 - Service: CachemanXP (CachemanXPService) - OuterTechnologies - C:\\PROGRA~1\\CACHEM~1\\CachemanXP.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\\WINDOWS\\system32\\CTsvcCDA.EXE O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\\Program Files\\Common Files\\Macrovision Shared\\FLEXnet Publisher\\FNPLicensingService.exe O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\\Program Files\\Google\\Update\\GoogleUpdate.exe O23 - Service: Google Software Updater (gusvc) - Google - C:\\Program Files\\Google\\Common\\Google Updater\\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\\Program Files\\Common Files\\InstallShield\\Driver\\1050\\Intel 32\\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\\Program Files\\iPod\\bin\\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\\Program Files\\Java\\jre6\\bin\\jqs.exe O23 - Service: Norton Internet Security (NIS) - Symantec Corporation - C:\\Program Files\\Norton Internet Security\\Engine\\17.8.0.5\\ccSvcHst.exe O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\\Program Files\\Common Files\\New Boundary\\PrismXL\\PRISMXL.SYS O23 - Service: Stuffit Archive Name Service - Smith Micro Software, Inc. - C:\\Program Files\\Smith Micro\\StuffIt11\\ArcNameService.exe O23 - Service: TabletServiceWacom - Wacom Technology, Corp. - C:\\WINDOWS\\system32\\Wacom_Tablet.exe O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\\Program Files\\Yahoo!\\SoftwareUpdate\\YahooAUService.exe -- End of file - 22615 bytes "
<https://forums.malwarebytes.com/topic/64228-rootkit-or-am-i-paranoid/>