DDS (Ver_09-06-26.01) - FAT32x86 Run by [removed] at 18:20:36.81 on Mon 07/06/2009 Internet Explorer: 6.0.2900.2180 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.384.67 [GMT -4:00] ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch SVCHOST.EXE C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe -k netsvcs SVCHOST.EXE SVCHOST.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Windows Defender\MSASCui.exe SVCHOST.EXE C:\Download\Profilers\PrcView\PrcView.exe C:\WINDOWS\system32\svchost.exe -k drv C:\WINDOWS\system32\svchost.exe -k imgsvc C:\Documents and Settings\mike\Desktop\ProcessExp\procexp.exe svchost C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\devldr32.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\Windows NT\Accessories\wordpad.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\Desktop\tmp\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://www.google.com/ mDefault_Page_URL = hxxp://www.msn.com TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File EB: RealGuide: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\SHDOCVW.DLL mRun: [SystemTray] SysTray.Exe mRun: [Windows Defender] "c:\program files\windows defender\MSASCui.exe" -hide mRun: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\shortc~1.lnk - c:\download\profilers\prcview\PrcView.exe uPolicies-explorer: = 00000000 uPolicies-explorer: NoFavoritesMenu = 01000000 uPolicies-explorer: NoNetworkConnections = 01000000 uPolicies-system: EnableProfileQuota = 1 (0x1) dPolicies-explorer: = 00000000 dPolicies-explorer: NoFavoritesMenu = 01000000 IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\windows\system32\msjava.dll IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\SHDOCVW.DLL DPF: DirectAnimation Java Classes - file://c:\windows\system\dajava.cab DPF: Internet Explorer Classes for Java - file://c:\windows\system\iejava.cab DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab DPF: {00000161-0000-0010-8000-00AA00389B71} - hxxp://codecs.microsoft.com/codecs/i386/msaudio.cab DPF: {3334504D-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/0/C/8/0C8EDFAB-30BC-4792-898E-2DABE27B2C4D/mp43dmo.CAB DPF: {33564D57-0000-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB DPF: {33564D57-9980-0010-8000-00AA00389B71} - hxxp://codecs.microsoft.com/codecs/i386/wmv9dmo.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} - hxxp://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?39312.4340162037 DPF: {CAFEEFAC-0014-0002-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab SEH: Eudora's Shell Extension: {edb0e980-90bd-11d4-8599-0008c7d3b6f8} - c:\program files\qualcomm\eudora\EUSHLEXT.DLL SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\window~4\MpShHook.dll ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\mike\applic~1\mozilla\firefox\profiles\zit26nr1.default\ FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxp://www.mozilla.org/start/ FF - plugin: c:\program files\netscape\communicator\program\plugins\NPAdbESD.dll FF - plugin: c:\program files\netscape\communicator\program\plugins\NPDOC.DLL FF - plugin: c:\program files\netscape\communicator\program\plugins\NPDocBox.dll FF - plugin: c:\program files\netscape\communicator\program\plugins\npdrmv2.dll FF - plugin: c:\program files\netscape\communicator\program\plugins\npdsplay.dll FF - plugin: c:\program files\netscape\communicator\program\plugins\NPJava11.dll FF - plugin: c:\program files\netscape\communicator\program\plugins\NPJava12.dll FF - plugin: c:\program files\netscape\communicator\program\plugins\NPJava13.dll FF - plugin: c:\program files\netscape\communicator\program\plugins\NPJava14.dll FF - plugin: c:\program files\netscape\communicator\program\plugins\NPJava32.dll FF - plugin: c:\program files\netscape\communicator\program\plugins\NPJPI142_15.dll FF - plugin: c:\program files\netscape\communicator\program\plugins\NPMHPNS.DLL FF - plugin: c:\program files\netscape\communicator\program\plugins\NPOJI610.dll FF - plugin: c:\program files\netscape\communicator\program\plugins\nppdf32.dll FF - plugin: c:\program files\netscape\communicator\program\plugins\npqtplugin.dll FF - plugin: c:\program files\netscape\communicator\program\plugins\npqtplugin2.dll FF - plugin: c:\program files\netscape\communicator\program\plugins\npqtplugin3.dll FF - plugin: c:\program files\netscape\communicator\program\plugins\npqtplugin4.dll FF - plugin: c:\program files\netscape\communicator\program\plugins\npqtplugin5.dll FF - plugin: c:\program files\netscape\communicator\program\plugins\npqtplugin6.dll FF - plugin: c:\program files\netscape\communicator\program\plugins\nprfxins.dll FF - plugin: c:\program files\netscape\communicator\program\plugins\NPSVGVw.dll FF - plugin: c:\program files\netscape\communicator\program\plugins\npwmsdrm.dll FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} ============= SERVICES / DRIVERS =============== R?2 drv;drv;c:\windows\system32\svchost.exe -k drv [2007-5-27 14336] R1 drvdrv;drvdrv;c:\program files\drv\drv.sys [2009-7-3 9344] R2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592] S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2007-11-6 34064] =============== Created Last 30 ================ 2009-07-04 06:57 208,744 a------- c:\windows\system32\muweb.dll 2009-07-03 12:49 --d----- c:\program files\Trend Micro 2009-07-03 12:06 12,544 a------- c:\windows\system32\iehelper.dll 2009-07-03 10:39 --d----- c:\program files\drv 2009-07-03 10:39 306,432 a------- c:\windows\sysguard.bak 2009-07-03 10:38 28,672 a------- c:\windows\ld12.bak ==================== Find3M ==================== 2009-07-03 18:59 1,632 a------- c:\windows\system32\d3d8caps.dat 2009-05-07 11:44 344,064 a------- c:\windows\system32\localspl.dll 2009-05-07 11:44 344,064 a------- c:\windows\system32\dllcache\localspl.dll 2009-04-27 05:17 18,432 a------- c:\windows\system32\dllcache\iedw.exe 2009-04-17 05:58 1,846,656 a------- c:\windows\system32\win32k.sys 2009-04-17 05:58 1,846,656 a------- c:\windows\system32\dllcache\win32k.sys 2009-04-15 11:11 584,192 a------- c:\windows\system32\rpcrt4.dll 2009-04-15 11:11 584,192 a------- c:\windows\system32\dllcache\rpcrt4.dll 2008-09-20 19:09 48,408 a------- c:\docume~1\mike\applic~1\GDIPFONTCACHEV1.DAT 2005-03-14 13:01 266 ---sh--- c:\program files\desktop.ini 2005-03-14 13:01 11,079 ----h--- c:\program files\folder.htt ============= FINISH: 18:21:06.93 ===============