Tried removing with Norton, but it won't. Tried using AVG, but it says "not readable". It appears that zonebac has attached to Symantecs ccApp.exe. Any help is greatly appreciated!

System Restore? Coming home from very lonely places, all of us go a little mad: whether from great personal success, or just an all-night drive, we are the sole survivors of a world no one else has ever seen. -

Please download and install the latest version of HijackThis v2.0.2: Download the "HijackThis" Installer from this link: Hijack This 1. Save " HJTInstall.exe" to your desktop. 2. Double click on HJTInstall.exe to run the program. 3. By default it will install to C:\Program Files\Trend Micro\HijackThis. 4. Accept the license agreement by clicking the "I Accept" button. 5.Click on the "Do a system scan and save a log file" button. It will scan and then ask you to save the log. 6. Click "Save log" to save the log file and then the log will open in Notepad. 7. Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log. 8. Paste the log in your next reply. 9. Do NOT have HijackThis fix anything yet! Most of what it finds will be harmless or even required. Please download FindAWF from the following link: http://noahdfear.geekstogo.com/FindAWF.exe Double-click on the FindAWF.exe file to run it. It will open a command prompt and ask you to "Press any key to continue". You will be presented with a Menu. 1. Press 1 then Enter to scan for bak folders 2. Press 2 then Enter to restore files from bak folders 3. Press 3 then Enter to remove bak folders 4. Press 4 then Enter to reset domain zones 5. Press E then Enter to EXIT Press 1 then press Enter. Copy and paste the contents of the AWF.txt file in your next reply.

Thanks jabuck ~ Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2:02:55 PM, on 2/16/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16608) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Windows Media Player\WMPNSCFG.exe C:\Program Files\D-Link\AirPlus G Wireless Adapter Utility\AirPlus.exe C:\Program Files\Common Files\Symantec Shared\bak\ccApp.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.exe C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Internet Explorer\IEXPLORE.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\Program Files\Grisoft\AVG7\avgcc.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\Program Files\Internet Explorer\IEXPLORE.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?Lin... R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?Lin... R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?Lin... R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?Lin... O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe O4 - HKLM\..\Run: [ccRegVfy] C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Zune Launcher] "C:\Program Files\Zune\ZuneLauncher.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user') O4 - Global Startup: D-Link AirPlus G Wireless Utility.lnk = ? O4 - Global Startup: D-Link REG Utility.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microso... O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.... O16 - DPF: {AE6C4705-0F11-4ACB-BDD4-37F138BEF289} (Image Uploader Control) - http://www.ritzpix.com/net/Uploader... O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe (file missing) O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe -- End of file - 6462 bytes Find AWF report by noahdfear ©2006 Version 1.40 The current date is: Sun 02/17/2008 The current time is: 6:03:35.47 bak folders found ~~~~~~~~~~~ Directory of C:\PROGRA~1\MESSEN~1\BAK 0 File(s) 0 bytes Directory of C:\PROGRA~1\WINDOW~2\BAK 10/18/2006 08:05 PM 204,288 WMPNSCFG.exe 1 File(s) 204,288 bytes Directory of C:\PROGRA~1\ZUNE\BAK 03/14/2007 04:03 PM 24,104 ZuneLauncher.exe 1 File(s) 24,104 bytes Directory of C:\WINDOWS\SYSTEM32\BAK 08/04/2004 06:00 AM 15,360 ctfmon.exe 1 File(s) 15,360 bytes Directory of C:\PROGRA~1\COMMON~1\SYMANT~1\BAK 08/19/2002 10:22 PM 50,880 ccApp.exe 08/19/2002 10:23 PM 34,504 ccRegVfy.exe 2 File(s) 85,384 bytes Directory of C:\PROGRA~1\ADOBE\READER~1.0\READER\BAK 10/10/2007 06:51 PM 39,792 Reader_sl.exe 1 File(s) 39,792 bytes Duplicate files of bak directory contents ~~~~~~~~~~~~~~~~~~~~~~~ 204288 Oct 18 2006 "C:\Program Files\Windows Media Player\wmpnscfg.exe" 204288 Oct 18 2006 "C:\Program Files\Windows Media Player\bak\WMPNSCFG.exe" 24104 Mar 14 2007 "C:\Program Files\Zune\bak\ZuneLauncher.exe" 15360 Aug 4 2004 "C:\WINDOWS\system32\ctfmon.exe" 15360 Aug 4 2004 "C:\WINDOWS\system32\bak\ctfmon.exe" 14348 Jan 28 2008 "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" 50880 Aug 19 2002 "C:\Program Files\Common Files\Symantec Shared\bak\ccApp.exe" 34504 Aug 19 2002 "C:\Program Files\Common Files\Symantec Shared\bak\ccRegVfy.exe" 39792 Oct 10 2007 "C:\Program Files\Adobe\Reader 8.0\Reader\bak\Reader_sl.exe" end of report

Double-click the FindAWF icon once again If a Security Alert shows, allow the program to run. As instructed, press any key to continue. Use the following option: Press 2 then Enter to restore files from bak folders A text file opens called: files.txt Copy/paste the following list of bolded files to be restored: "C:\Program Files\Windows Media Player\bak\WMPNSCFG.exe" "C:\Program Files\Zune\bak\ZuneLauncher.exe" 15360 Aug 4 2004 "C:\WINDOWS\system32\bak\ctfmon.exe" "C:\Program Files\Common Files\Symantec Shared\bak\ccApp.exe" "C:\Program Files\Common Files\Symantec Shared\bak\ccRegVfy.exe" "C:\Program Files\Adobe\Reader 8.0\Reader\bak\Reader_sl.exe" Next, close and click Yes to save the changes. Once files.txt is saved, FindAWF does the following: -It attempts to terminate the process represented by each filename on the list, if running -Deletes the rogue file from the parent folder, if present -Copies the original file to the parent folder When done with the above, it automatically runs a new scan and opens a new log. Please provide the new FindAWF log in your reply. Please download ComboFix to the desktop from one of the following links: Link1 Link 2 Link 3 Double-click combofix.exe Follow the prompts. (Don't click on the window while the program is running, it may cause your system to hang.) Please post the log it produces.

Working on the Combo, here's the AWF: Find AWF report by noahdfear ©2006 Version 1.40 Option 2 run successfully The current date is: Sun 02/17/2008 The current time is: 7:57:50.36 bak folders found ~~~~~~~~~~~ Directory of C:\PROGRA~1\MESSEN~1\BAK 0 File(s) 0 bytes Directory of C:\PROGRA~1\WINDOW~2\BAK 10/18/2006 08:05 PM 204,288 WMPNSCFG.exe 1 File(s) 204,288 bytes Directory of C:\PROGRA~1\ZUNE\BAK 03/14/2007 04:03 PM 24,104 ZuneLauncher.exe 1 File(s) 24,104 bytes Directory of C:\WINDOWS\SYSTEM32\BAK 08/04/2004 06:00 AM 15,360 ctfmon.exe 1 File(s) 15,360 bytes Directory of C:\PROGRA~1\COMMON~1\SYMANT~1\BAK 08/19/2002 10:22 PM 50,880 ccApp.exe 08/19/2002 10:23 PM 34,504 ccRegVfy.exe 2 File(s) 85,384 bytes Directory of C:\PROGRA~1\ADOBE\READER~1.0\READER\BAK 10/10/2007 06:51 PM 39,792 Reader_sl.exe 1 File(s) 39,792 bytes Duplicate files of bak directory contents ~~~~~~~~~~~~~~~~~~~~~~~ 204288 Oct 18 2006 "C:\Program Files\Windows Media Player\WMPNSCFG.exe" 204288 Oct 18 2006 "C:\Program Files\Windows Media Player\bak\WMPNSCFG.exe" 24104 Mar 14 2007 "C:\Program Files\Zune\ZuneLauncher.exe" 24104 Mar 14 2007 "C:\Program Files\Zune\bak\ZuneLauncher.exe" 15360 Aug 4 2004 "C:\WINDOWS\system32\ctfmon.exe" 15360 Aug 4 2004 "C:\WINDOWS\system32\bak\ctfmon.exe" 50880 Aug 19 2002 "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" 50880 Aug 19 2002 "C:\Program Files\Common Files\Symantec Shared\bak\ccApp.exe" 34504 Aug 19 2002 "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe" 34504 Aug 19 2002 "C:\Program Files\Common Files\Symantec Shared\bak\ccRegVfy.exe" 39792 Oct 10 2007 "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" 39792 Oct 10 2007 "C:\Program Files\Adobe\Reader 8.0\Reader\bak\Reader_sl.exe" end of report

ComboFix 08-02-17.2 - Ashley R 2008-02-17 8:14:56.1 - NTFSx86 Running from: C:\Documents and Settings\Ashley R\Desktop\ComboFix.exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat ----- BITS: Possible infected sites ----- hxxp://au.download.windowsupdaõj . ((((((((((((((((((((((((( Files Created from 2008-01-17 to 2008-02-17 ))))))))))))))))))))))))))))))) . 2008-02-16 14:01 . 2008-02-16 14:01 <DIR> d-------- C:\Program Files\Trend Micro 2008-02-16 11:16 . 2008-02-16 11:16 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\AVG7 2008-02-16 11:16 . 2008-02-17 08:00 <DIR> d-------- C:\Documents and Settings\Ashley R\Application Data\AVG7 2008-02-16 11:16 . 2008-02-16 11:16 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll 2008-02-16 11:16 . 2008-02-16 11:16 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll 2008-02-16 11:15 . 2008-02-16 11:15 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft 2008-02-16 11:15 . 2008-02-16 11:21 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg7 2008-02-10 10:19 . 2004-08-04 06:00 221,184 --a------ C:\WINDOWS\system32\wmpns.dll 2008-01-29 11:35 . 2008-01-29 11:35 <DIR> d-------- C:\WINDOWS\Sun 2008-01-29 11:34 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-01-29 11:32 . 2008-01-29 11:34 <DIR> d-------- C:\Program Files\Java 2008-01-29 11:31 . 2008-01-29 11:31 <DIR> d-------- C:\Program Files\Common Files\Java 2008-01-28 21:19 . 2008-01-28 21:19 <DIR> d-------- C:\WINDOWS\system32\bak 2008-01-24 19:20 . 2008-01-24 20:18 664 --a------ C:\WINDOWS\system32\d3d9caps.dat 2008-01-24 19:15 . 2008-01-24 19:15 <DIR> d-------- C:\Program Files\Disney . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-02-17 13:57 --------- d-----w C:\Program Files\Zune 2008-02-17 13:57 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-02-16 01:46 --------- d-----w C:\Program Files\Norton SystemWorks 2007-12-18 09:51 179,584 ----a-w C:\WINDOWS\system32\drivers\mrxdav.sys 2007-12-07 02:21 824,832 ----a-w C:\WINDOWS\system32\wininet.dll 2007-12-04 18:38 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll 2007-02-24 00:19 32 --sha-w C:\WINDOWS\{25768A09-588F-4782-81CA-D7C8F4E1A89D}.dat 2007-02-24 00:21 32 --sha-w C:\WINDOWS\{4D1AE55B-C6EF-494E-95C2-644A78C74023}.dat 2007-02-24 00:22 32 --sha-w C:\WINDOWS\{5BE86C08-C20F-4CB1-9DC2-488D154021E3}.dat 2007-02-24 00:19 32 --sha-w C:\WINDOWS\{A21A9C00-0735-452C-A2EE-76A18C77484F}.dat 2007-02-24 00:19 32 --sha-w C:\WINDOWS\{E5017D81-4B15-48D9-9F94-65DBA8089096}.dat 2007-02-24 00:17 32 --sha-w C:\WINDOWS\{E619BDA7-58AF-41F9-B5A3-72E6AAE06F33}.dat 2007-02-24 00:20 32 --sha-w C:\WINDOWS\{EBBBBDF6-3C52-4D20-A90A-2CAE52721DD9}.dat 2007-02-24 00:19 32 --sha-w C:\WINDOWS\system32\{021B3831-487A-4F11-9999-E0C50D790436}.dat 2007-02-24 00:19 32 --sha-w C:\WINDOWS\system32\{0A22BE94-431E-467E-ADF4-BD3E1E6554F0}.dat 2007-02-24 00:20 32 --sha-w C:\WINDOWS\system32\{26A23F00-986D-40D4-9F10-EC7013374CC1}.dat 2007-02-24 00:19 32 --sha-w C:\WINDOWS\system32\{916854CC-7772-4EFC-92D4-F91536897714}.dat 2007-02-24 00:22 32 --sha-w C:\WINDOWS\system32\{9B147B38-BA0E-412D-9AEA-978B596CC2B6}.dat 2007-02-24 00:17 32 --sha-w C:\WINDOWS\system32\{9FE839B9-0FF4-482B-8480-F1D1399B4CDE}.dat 2007-02-24 00:21 32 --sha-w C:\WINDOWS\system32\{F60D3C07-FC5E-4F7A-918E-001628455781}.dat . ((((((((((((((((((((((((((((((((((((((((((((( AWF )))))))))))))))))))))))))))))))))))))))))))))))))))))))))) . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 10:24 1694208] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 06:00 15360] "WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 20:05 204288] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2002-08-19 22:22 50880] "ccRegVfy"="C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe" [2002-08-19 22:23 34504] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 18:51 39792] "Zune Launcher"="C:\Program Files\Zune\ZuneLauncher.exe" [2007-03-14 16:03 24104] "QD FastAndSafe"="" [] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-02-16 11:15 579072] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-02-16 11:16 219136] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ D-Link AirPlus G Wireless Utility.lnk - C:\Program Files\D-Link\AirPlus G Wireless Adapter Utility\AirPlus.exe [2007-02-23 18:51:46 782412] D-Link REG Utility.lnk - C:\Program Files\D-Link\AirPlus G Wireless Adapter Utility\Reg.exe [2007-02-23 18:51:45 24576] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.exe [2001-02-13 02:01:04 83360] R2 BjsPort;Canon BJ Scanner Port Driver;C:\WINDOWS\system32\drivers\BjsPort.SYS [1999-09-27 09:47] R3 neo20xx;neo20xx;C:\WINDOWS\system32\DRIVERS\neo20xx.sys [2001-08-17 06:50] R3 NPDriver;Norton Unerase Protection Driver;C:\WINDOWS\system32\Drivers\NPDRIVER.SYS [2002-08-14 06:03] R3 OBOE;Toshiba FIR Port Type-O;C:\WINDOWS\system32\DRIVERS\tos4mo.sys [2001-08-17 06:10] R3 wdm_opl3sax;YAMAHA OPL3-SAx Audio Driver (WDM);C:\WINDOWS\system32\drivers\opl3sax.sys [2001-08-17 06:20] *Newly Created Service* - AVG7ALRT *Newly Created Service* - AVG7CORE *Newly Created Service* - AVG7RSW *Newly Created Service* - AVG7RSXP *Newly Created Service* - AVG7UPDSVC *Newly Created Service* - AVGCLEAN . Contents of the 'Scheduled Tasks' folder "2008-02-16 17:29:09 C:\WINDOWS\Tasks\Norton AntiVirus - Scan my computer.job" - C:\PROGRA~1\NORTON~1\NORTON~1\NAVW32.exe "2008-02-16 01:46:03 C:\WINDOWS\Tasks\Norton SystemWorks One Button Checkup.job" - C:\Program Files\Norton SystemWorks\OBC.exe "2008-02-17 14:06:39 C:\WINDOWS\Tasks\Symantec NetDetect.job" - C:\Program Files\Symantec\LiveUpdate\NDETECT.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-02-17 08:23:38 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-02-17 8:26:39 ComboFix-quarantined-files.txt 2008-02-17 14:26:19 . 2008-02-14 09:12:43 --- E O F ---