DDS (Ver_10-03-17.01) - NTFSx86 Run by [removed] at 8:57:03.44 on Wed 05/05/2010 Internet Explorer: 6.0.2800.1106 BrowserJavaVersion: 1.6.0_11 Microsoft Windows XP Home Edition 5.1.2600.1.1252.1.1033.18.735.487 [GMT -5:00] ============== Running Processes =============== C:\WINDOWS\system32\svchost -k rpcss svchost.exe svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\ATT-SST\McciTrayApp.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\AT&T\Internet Security Wizard\ISW.exe C:\Program Files\LeapFrog\LeapFrog Connect\Monitor.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\WINDOWS\system32\svchost.exe -k hpdevmgmt C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\LeapFrog\LeapFrog Connect\CommandService.exe C:\Program Files\Common Files\Motive\McciCMService.exe C:\WINDOWS\System32\PSIService.exe C:\WINDOWS\System32\svchost.exe -k imgsvc C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE C:\Documents and Settings\jessc0125\Local Settings\Application Data\av.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\svchost.exe -k netsvcs C:\Documents and Settings\jessc0125\Desktop\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://swagbucks.com/ uSearch Page = hxxp://www.google.com uSearch Bar = hxxp://www.google.com/ie mDefault_Page_URL = hxxp://www.yahoo.com/ mDefault_Search_URL = hxxp://www.google.com/ie mSearch Page = hxxp://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*http://www.yahoo.com mStart Page = hxxp://www.yahoo.com/ mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s mSearchAssistant = hxxp://www.google.com/ie mURLSearchHooks: H - No File BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File BHO: {3345db50-a4df-4235-b436-11f0f717b913} - c:\windows\system32\zulerudo.dll BHO: AT&&T Toolbar: {4e7bd74f-2b8d-469e-94be-fd60bb9aae29} - c:\progra~1\atttoo~1\ATTTOO~1.DLL BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.4.4525.1752\swg.dll BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: AT&&T Toolbar: {4e7bd74f-2b8d-469e-94be-fd60bb9aae29} - c:\progra~1\atttoo~1\ATTTOO~1.DLL TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File TB: {472734EA-242A-422B-ADF8-83D1E48CC825} - No File EB: {4528BBE0-4E08-11D5-AD55-00010333D0AD} - No File EB: Media Band: {32683183-48a0-441b-a342-7c2a440a9478} - %SystemRoot%\System32\browseui.dll uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background uRun: [AIM] c:\program files\aim\aim.exe -cnetwait.odl uRun: [ares] "c:\program files\ares\Ares.exe" -h uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe" uRun: [Search Protection] c:\program files\yahoo!\search protection\SearchProtection.exe uRun: [slypcnri] c:\documents and settings\jessc0125\local settings\application data\orbkxh\uwdrsysguard.exe uRun: [DW6] "c:\program files\the weather channel fw\desktop\DesktopWeather.exe" uRun: [qgmgcfvj] c:\documents and settings\jessc0125\local settings\application data\yfuppc\lwwlsftav.exe mRun: [SoundMan] SOUNDMAN.EXE mRun: [BluetoothAuthenticationAgent] rundll32.exe irprops.cpl,,BluetoothAuthenticationAgent mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe mRun: [34fb7d53] rundll32.exe "c:\windows\system32\toretewo.dll",b mRun: [riwituziyo] Rundll32.exe "c:\windows\system32\fureboze.dll",s mRun: [CPM37c84ecf] Rundll32.exe "c:\windows\system32\dimisawo.dll",a mRun: [ATT-SST_McciTrayApp] "c:\program files\att-sst\McciTrayApp.exe" mRun: [ISW.exe] "c:\program files\at&t\internet security wizard\ISW.exe" /AUTORUN mRun: [slypcnri] c:\documents and settings\jessc0125\local settings\application data\orbkxh\uwdrsysguard.exe mRun: [Monitor] "c:\program files\leapfrog\leapfrog connect\Monitor.exe" mRun: [qgmgcfvj] c:\documents and settings\jessc0125\local settings\application data\yfuppc\lwwlsftav.exe dRun: [AVG7_Run] c:\progra~1\grisoft\avgfre~1\avgw.exe /RUNONCE dRunOnce: [SGD] "c:\windows\temp\wobebupi.exe" /cs:0 StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000 DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab DPF: {0A7469E8-9D33-4386-90A5-705E0E55C8F8} - hxxp://healthyschools.net/HRMx/hrmctl.cab DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab DPF: {42D06124-98A2-47EC-8098-3778B58CE7D5} - hxxp://connect.comcast.com/dl/Comcast%20Activation%20Controls.cab DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - hxxp://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,99/mcinsctl.cab DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} - hxxp://upload.facebook.com/controls/FacebookPhotoUploader.cab DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - hxxp://download.mcafee.com/molbin/shared/mcgdmgr/1,0,0,26/mcgdmgr.cab DPF: {CAFEEFAC-0015-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_01-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab TCP: {D52ABD80-4988-4C7D-84BF-E2D39090D0E1} = 217.23.14.75,4.2.2.1,192.168.1.254 Notify: acpiz - acpiz.dll AppInit_DLLs: tovuriro.dll SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\dimisawo.dll STS: STS: {ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} - c:\windows\system32\dimisawo.dll LSA: Notification Packages = scecli c:\windows\system32\vifagaso.dll rifojehu.dll Hosts: 82.98.231.89 browser-security.microsoft.com Hosts: 82.98.231.89 best-click-scanner.info Hosts: 82.98.231.89 antivirus-xp-pro-2009.com Hosts: 82.98.231.89 microsoft.infosecuritycenter.com Hosts: 82.98.231.89 microsoft.softwaresecurityhelp.com Note: multiple HOSTS entries found. Please refer to Attach.txt ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\jessc0~1\applic~1\mozilla\firefox\profiles\epyp8tj7.default user\ FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2260173&SearchSource=3&q={searchTerms} FF - prefs.js: browser.search.selectedEngine - Swag Bucks Customized Web Search FF - prefs.js: browser.startup.homepage - swagbucks.com FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2260173&q= FF - component: c:\documents and settings\jessc0125\application data\mozilla\firefox\profiles\epyp8tj7.default user\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll FF - component: c:\documents and settings\jessc0125\application data\mozilla\firefox\profiles\epyp8tj7.default user\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\components\FFExternalAlert.dll FF - component: c:\documents and settings\jessc0125\application data\mozilla\firefox\profiles\epyp8tj7.default user\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\components\RadioWMPCore.dll FF - plugin: c:\documents and settings\jessc0125\application data\facebook\npfbplugin_1_0_3.dll FF - plugin: c:\program files\google\picasa3\npPicasa3.dll FF - plugin: c:\program files\mozilla firefox\plugins\NPcol308.dll FF - plugin: c:\program files\mozilla firefox\plugins\npCouponPrinter.dll FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} ---- FIREFOX POLICIES ---- FF - user.js: yahoo.homepage.dontask - truec:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true); c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true); c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32); c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600); c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false); c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5); c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", ""); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com"); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20); ============= SERVICES / DRIVERS =============== S1 acup;VPower Control Service;c:\windows\system32\acup.sys --> c:\windows\system32\acup.sys [?] S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [2007-5-30 17920] S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [2007-5-30 7680] S3 MotDev;Motorola Inc. USB Device;c:\windows\system32\drivers\motodrv.sys [2007-5-30 40832] S3 motport;Motorola USB Diagnostic Port;c:\windows\system32\drivers\motport.sys [2007-5-30 21632] =============== Created Last 30 ================ ==================== Find3M ==================== 2010-04-03 01:53:28 44032 ---ha-w- c:\windows\system32\clipac32.dll 2010-03-29 20:24:58 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-03-29 20:24:44 19160 ----a-w- c:\windows\system32\drivers\mbam.sys 2010-03-29 01:30:49 86912 ----a-w- c:\windows\system32\drivers\atapi.sys 2008-12-12 17:41:01 168 --sh--r- c:\windows\system32\690A7241F3.sys 1601-01-01 00:03:21 64512 --sha-w- c:\windows\system32\huyowoza.exe 1601-01-01 00:03:21 70144 --sha-w- c:\windows\system32\kekuzevi.dll 2008-12-12 17:41:09 3662 --sha-w- c:\windows\system32\KGyGaAvL.sys 1601-01-01 00:03:21 55296 --sha-w- c:\windows\system32\kiropevu.dll 1601-01-01 00:03:21 50176 --sha-w- c:\windows\system32\rekomeve.exe 1601-01-01 00:12:31 56320 --sha-w- c:\windows\system32\rifojehu.dll 1601-01-01 00:03:21 49152 --sha-w- c:\windows\system32\rodusano.dll 1601-01-01 00:03:21 49152 --sha-w- c:\windows\system32\silugihi.dll 1601-01-01 00:12:31 56320 --sha-w- c:\windows\system32\tovuriro.dll 1601-01-01 00:12:31 56320 --sha-w- c:\windows\system32\wakanede.dll 1601-01-01 00:03:21 201728 --sha-w- c:\windows\system32\wobebupi.exe 1601-01-01 00:03:21 49152 --sha-w- c:\windows\system32\zonokiro.dll 1601-01-01 00:03:21 201728 --sha-w- c:\windows\temp\wobebupi.exe ============= FINISH: 8:59:29.67 ===============