DDS (Ver_09-12-01.01) - NTFSx86 Run by [removed] at 12:39:24.01 on Wed 12/30/2009 Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_17 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1535.830 [GMT -5:00] AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7} FW: COMODO Firewall *enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B} ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch C:\WINDOWS\system32\svchost -k rpcss C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe C:\WINDOWS\system32\svchost.exe -k netsvcs C:\WINDOWS\System32\svchost.exe -k NetworkService C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Avira\AntiVir Desktop\sched.exe C:\Program Files\a-squared Free\a2service.exe C:\Program Files\Avira\AntiVir Desktop\avguard.exe C:\WINDOWS\System32\GEARSec.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Avira\AntiVir Desktop\avgnt.exe C:\Program Files\COMODO\SafeSurf\cssurf.exe C:\Program Files\COMODO\COMODO Internet Security\cfp.exe C:\Program Files\ThreatFire\TFTray.exe C:\Program Files\ThreatFire\TFService.exe C:\Program Files\AccuWeather\Desktop\AccuWeatherDesktop.exe C:\Program Files\NETGEAR\WPN111\wpn111.exe C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\StickyNotes.exe C:\WINDOWS\system32\devldr32.exe C:\WINDOWS\System32\svchost.exe -k LocalService C:\WINDOWS\System32\alg.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\KeePass Password Safe 2\KeePass.exe C:\Documents and Settings\Funkyecat.CAT-QHX5BCU0EJ3\Desktop\dds.scr C:\WINDOWS\system32\wbem\wmiprvse.exe ============== Pseudo HJT Report =============== uSearch Page = hxxp://us.rd.yahoo.com/customize/ycomp/defaults/sp/*http://www.yahoo.com uSearch Bar = hxxp://us.rd.yahoo.com/customize/ycomp/defaults/sb/*http://www.yahoo.com/search/ie.html mDefault_Search_URL = hxxp://toolbar.ask.com/toolbarv/askRedirect?o=1665&gct=&gc=1&q= uSearchURL,(Default) = hxxp://toolbar.ask.com/toolbarv/askRedirect?o=1665&gct=&gc=1&q=%s BHO: LastPass Browser Helper Object: {95d9ecf5-2a4d-4550-be49-70d42f71296e} - c:\program files\lastpass\LPBar.dll BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: LastPass Toolbar: {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - c:\program files\lastpass\LPBar.dll TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File mRun: [nwiz] nwiz.exe /install mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min /nosplash mRun: [COMODO SafeSurf] "c:\program files\comodo\safesurf\cssurf.exe" -s mRun: [COMODO Internet Security] "c:\program files\comodo\comodo internet security\cfp.exe" -h mRun: [ThreatFire] c:\program files\threatfire\TFTray.exe StartupFolder: c:\docume~1\alluse~1.win\startm~1\programs\startup\accuwe~1.lnk - c:\program files\accuweather\desktop\AccuWeatherDesktop.exe StartupFolder: c:\docume~1\alluse~1.win\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office\OSA9.EXE StartupFolder: c:\docume~1\alluse~1.win\startm~1\programs\startup\netgea~1.lnk - c:\program files\netgear\wpn111\wpn111.exe StartupFolder: c:\documents and settings\all users.windows\start menu\programs\startup\StickyNotes.exe IE: LastPass - file://c:\program files\lastpass\context.html?cmd=lastpass IE: LastPass Fill Forms - file://c:\program files\lastpass\context.html?cmd=fillforms IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab DPF: Microsoft XML Parser for Java DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1258757362062 DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1258757450125 DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\program files\belarc\advisor\system\BAVoilaX.dll Notify: LBTWlgn - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll AppInit_DLLs: c:\windows\system32\cssdll32.dll c:\windows\system32\guard32.dll LSA: Authentication Packages = msv1_0 relog_ap Hosts: 127.0.0.1 www.spywareinfo.com ============= SERVICES / DRIVERS =============== R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-10-26 64288] R0 PQV2i;PQV2i;c:\windows\system32\drivers\PQV2i.sys [2004-7-29 138780] R0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys [2009-12-15 51984] R0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys [2009-12-15 59664] R0 viasraid;viasraid;c:\windows\system32\drivers\viasraid.sys [2003-1-7 77056] R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2009-11-22 11608] R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdguard.sys [2009-11-28 133064] R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [2009-11-28 25160] R1 PQIMount;PQIMount;c:\windows\system32\drivers\PQIMount.sys [2004-7-29 46779] R2 a2free;a-squared Free Service;c:\program files\a-squared free\a2service.exe [2009-11-26 1858144] R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2009-11-22 108289] R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2009-11-22 185089] R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2009-11-22 56816] R2 cmdAgent;COMODO Internet Security Helper Service;c:\program files\comodo\comodo internet security\cmdagent.exe [2009-11-28 723632] R2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [2009-10-26 10384] R2 ThreatFire;ThreatFire;c:\program files\threatfire\tfservice.exe service --> c:\program files\threatfire\TFService.exe service [?] R3 DNINDIS5;DNINDIS5 NDIS Protocol Driver;c:\windows\system32\DNINDIS5.sys [2009-11-20 17149] R3 TfNetMon;TfNetMon;c:\windows\system32\drivers\TfNetMon.sys [2009-12-15 33552] R3 WPN111;Wireless USB 2.0 Adapter with RangeMax Service;c:\windows\system32\drivers\WPN111.sys [2009-11-20 384608] S3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [2009-12-25 8704] S3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [2009-12-25 3072] S3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [2009-6-17 12648] S4 IS360service;IS360service;c:\program files\iobit\iobit security 360\is360srv.exe [2009-11-30 312592] S4 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-9-24 1181328] S4 MaxSch2Svc;Maxtor Scheduler2 Service;c:\program files\common files\maxtor\schedule2\schedul2.exe [2008-6-27 431384] S4 PCPitstop Scheduling;PCPitstop Scheduling;c:\program files\pcpitstop\PCPitstopScheduleService.exe [2009-11-27 90352] =============== Created Last 30 ================ 2009-12-30 00:45:15 0 d-----w- c:\program files\LastPass 2009-12-30 00:12:16 531 ----a-w- C:\hpfr5550.xml 2009-12-29 17:45:30 0 d-----w- c:\windows\system32\wbem\Repository 2009-12-29 01:23:56 12540 ----a-w- c:\windows\system32\wpa.bak 2009-12-26 20:35:10 1885464 ----a-w- c:\windows\system32\AutoPartNt.exe 2009-12-26 20:35:10 1024 ----a-w- c:\windows\system32\AutoPartNt.let 2009-12-26 19:49:18 306688 ----a-w- c:\windows\IsUninst.exe 2009-12-26 13:38:05 221184 ----a-w- c:\windows\system32\wmpns.dll 2009-12-26 02:38:25 0 d-----w- c:\windows\system32\URTTEMP 2009-12-26 01:41:39 1907 ----a-w- c:\windows\system32\PQ_BATCH.PQB 2009-12-26 01:38:22 3360 ------w- c:\windows\system32\drivers\PQNTDRV.SYS 2009-12-26 01:38:22 1357372 ------w- c:\windows\system32\XMNT2001.EXE 2009-12-26 01:38:13 0 d-----w- c:\program files\PowerQuest 2009-12-26 01:33:16 1663488 ----a-w- c:\windows\system32\BootMan.exe 2009-12-26 01:33:16 14848 ----a-w- c:\windows\system32\EuEpmGdi.dll 2009-12-26 01:33:15 8704 ----a-w- c:\windows\system32\epmntdrv.sys 2009-12-26 01:33:15 86408 ----a-w- c:\windows\system32\setupempdrv03.exe 2009-12-26 01:33:15 3072 ----a-w- c:\windows\system32\EuGdiDrv.sys 2009-12-26 01:11:50 2150 ---ha-r- c:\windows\EPMBatch.ept 2009-12-19 00:10:46 5331144 ----a-w- c:\program files\common files\lpuninstall.exe 2009-12-15 14:22:03 59664 ----a-w- c:\windows\system32\drivers\TfSysMon.sys 2009-12-15 14:22:03 51984 ----a-w- c:\windows\system32\drivers\TfFsMon.sys 2009-12-15 14:22:03 33552 ----a-w- c:\windows\system32\drivers\TfNetMon.sys 2009-12-14 17:14:27 0 d-----w- c:\windows\pss 2009-12-13 20:53:20 0 d-----w- c:\docume~1\funkye~1.cat\applic~1\Dropbox 2009-12-13 02:27:35 0 d-----w- c:\docume~1\alluse~1.win\applic~1\Stardock 2009-12-13 02:27:18 0 dc-h--w- c:\docume~1\alluse~1.win\applic~1\{198DF385-4721-45F3-BF73-6D54286CF458} 2009-12-13 02:27:16 0 d-----w- c:\program files\common files\Stardock 2009-12-13 02:27:16 0 d-----w- c:\program files\AccuWeather 2009-12-11 18:48:09 0 d-----w- c:\program files\Secunia 2009-12-09 20:38:58 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll 2009-12-06 05:13:14 0 d-----w- c:\program files\Microsoft CAPICOM 2.1.0.2 2009-12-04 13:02:35 0 d-----w- c:\docume~1\funkye~1.cat\applic~1\IsolatedStorage 2009-12-04 12:58:10 0 d-----w- c:\docume~1\alluse~1.win\applic~1\Symantec 2009-12-04 12:58:05 0 d-----w- c:\program files\Symantec 2009-12-04 12:58:05 0 d-----w- c:\program files\common files\Symantec Shared 2009-12-03 17:19:43 0 d--h--w- c:\windows\system32\GroupPolicy 2009-12-01 00:43:53 0 d-----w- c:\docume~1\alluse~1.win\applic~1\IObit ==================== Find3M ==================== 2009-12-11 15:15:55 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys 2009-12-03 21:14:06 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-12-03 21:13:56 19160 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-11-29 04:17:18 25160 ----a-w- c:\windows\system32\drivers\cmdhlp.sys 2009-11-29 04:17:18 171552 ----a-w- c:\windows\system32\guard32.dll 2009-11-29 04:17:18 133064 ----a-w- c:\windows\system32\drivers\cmdguard.sys 2009-11-27 16:20:42 93360 ----a-w- c:\windows\system32\drivers\SBREDrv.sys 2009-11-27 14:02:03 411368 ----a-w- c:\windows\system32\deploytk.dll 2009-11-26 23:39:11 249592 ----a-w- c:\windows\system32\cssdll32.dll 2009-11-20 21:10:50 21275 ----a-w- c:\windows\system32\drivers\AegisP.sys 2009-10-29 05:38:23 667136 ----a-w- c:\windows\system32\wininet.dll 2009-10-26 22:56:37 21640 ----a-w- c:\windows\system32\emptyregdb.dat 2009-10-21 05:38:36 75776 ----a-w- c:\windows\system32\strmfilt.dll 2009-10-21 05:38:36 25088 ----a-w- c:\windows\system32\httpapi.dll 2009-10-13 10:30:16 270336 ----a-w- c:\windows\system32\oakley.dll 2009-10-12 13:38:19 149504 ----a-w- c:\windows\system32\rastls.dll 2009-10-12 13:38:18 79872 ----a-w- c:\windows\system32\raschap.dll 2009-05-20 02:14:48 483328 ----a-w- c:\program files\StickyNotes.exe ============= FINISH: 12:42:02.98 ===============