DDS (Ver_10-03-17.01) - NTFSx86 Run by [removed] at 20:13:56.17 on Sun 07/25/2010 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_20 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2046.993 [GMT -4:00] AV: Webroot AntiVirus with Spy Sweeper *On-access scanning disabled* (Updated) {77E10C7F-2CCA-4187-9394-BDBC267AD597} ============== Running Processes =============== D:\Program Files\Webroot\WebrootSecurity\WRConsumerService.exe D:\WINDOWS\System32\nvsvc32.exe D:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe D:\Program Files\Windows Defender\MsMpEng.exe D:\WINDOWS\System32\svchost.exe -k netsvcs D:\WINDOWS\system32\svchost.exe -k WudfServiceGroup svchost.exe svchost.exe D:\WINDOWS\system32\spoolsv.exe svchost.exe D:\Program Files\a-squared Free\a2service.exe D:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe D:\Program Files\Bonjour\mDNSResponder.exe D:\WINDOWS\system32\CTsvcCDA.EXE D:\WINDOWS\System32\svchost.exe -k HTTPFilter D:\Program Files\WD\WD Anywhere Backup\MemeoBackgroundService.exe D:\WINDOWS\Explorer.EXE D:\WINDOWS\System32\svchost.exe -k imgsvc D:\Program Files\Webroot\WebrootSecurity\SpySweeper.exe D:\WINDOWS\system32\MsPMSPSv.exe D:\Program Files\D-Link\AirPlus Xtreme G\AirPlusCFG.exe D:\Program Files\Alpha Networks\ANIWZCS Service\WZCSLDR.exe D:\WINDOWS\system32\RUNDLL32.EXE D:\Program Files\Canon\MyPrinter\BJMyPrt.exe D:\Program Files\Common Files\Java\Java Update\jusched.exe D:\Program Files\iTunes\iTunesHelper.exe D:\Program Files\Creative\SBAudigy\Taskbar\CTLTray.exe D:\Program Files\Creative\SBAudigy\Taskbar\CTLTask.exe D:\WINDOWS\system32\ctfmon.exe D:\Program Files\Windows Media Player\WMPNSCFG.exe D:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe D:\Program Files\OpenOffice.org 3\program\soffice.exe D:\Program Files\OpenOffice.org 3\program\soffice.bin D:\Program Files\iPod\bin\iPodService.exe D:\Program Files\WD\WD Anywhere Backup\MemeoBackup.exe D:\Program Files\Mozilla Firefox\firefox.exe D:\WINDOWS\system32\wscntfy.exe D:\Documents and Settings\James.JAMES-DESKTOP\My Documents\Downloads\dds.scr ============== Pseudo HJT Report =============== uInternet Settings,ProxyOverride = *.local uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - d:\program files\yahoo!\companion\installs\cpn3\yt.dll BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - d:\program files\yahoo!\companion\installs\cpn3\yt.dll BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - d:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: AT&&T Toolbar: {4e7bd74f-2b8d-469e-94be-fd60bb9aae29} - d:\progra~1\atttoo~1\ATTTOO~1.DLL BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - d:\progra~1\spybot~1\SDHelper.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - d:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - d:\program files\yahoo!\companion\installs\cpn3\yt.dll TB: AT&&T Toolbar: {4e7bd74f-2b8d-469e-94be-fd60bb9aae29} - d:\progra~1\atttoo~1\ATTTOO~1.DLL EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File uRun: [SpybotSD TeaTimer] "d:\program files\spybot - search & destroy\TeaTimer.exe" uRun: [TaskTray] "d:\program files\creative\sbaudigy\taskbar\CTLTray.exe" uRun: [Taskbar] "d:\program files\creative\sbaudigy\taskbar\CTLTask.exe" uRun: [ctfmon.exe] "d:\windows\system32\ctfmon.exe" uRun: [WMPNSCFG] "d:\program files\windows media player\WMPNSCFG.exe" mRun: [D-Link AirPlus Xtreme G] "d:\program files\d-link\airplus xtreme g\AirPlusCFG.exe" mRun: [ANIWZCSService] "d:\program files\alpha networks\aniwzcs service\WZCSLDR.exe" mRun: [nwiz] "nwiz.exe" /install mRun: [NvMediaCenter] "RUNDLL32.EXE" d:\windows\system32\NvMcTray.dll,NvTaskbarInit mRun: [NvCplDaemon] "RUNDLL32.EXE" d:\windows\system32\NvCpl.dll,NvStartup mRun: [CanonSolutionMenu] "d:\program files\canon\solutionmenu\CNSLMAIN.exe" /logon mRun: [CanonMyPrinter] "d:\program files\canon\myprinter\BJMyPrt.exe" /logon mRun: [Kernel and Hardware Abstraction Layer] "KHALMNPR.EXE" mRun: [WinPatrol] "d:\program files\billp studios\winpatrol\winpatrol.exe" -expressboot mRun: [WD Anywhere Backup] "d:\program files\wd\wd anywhere backup\MemeoLauncher2.exe" --silent mRun: [UpdReg] "d:\windows\Updreg.exe" mRun: [CTStartup] "d:\program files\creative\sbaudigy\program\CTEaxSpl.EXE" /run mRun: [Jet Detection] "d:\program files\creative\sbaudigy\program\ADGJDet.exe" mRun: [KernelFaultCheck] "%systemroot%\system32\dumprep" 0 -k mRun: [Adobe Reader Speed Launcher] "d:\program files\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [Adobe ARM] "d:\program files\common files\adobe\arm\1.0\AdobeARM.exe" mRun: [SunJavaUpdateSched] "d:\program files\common files\java\java update\jusched.exe" mRun: [QuickTime Task] "d:\program files\quicktime\QTTask.exe" -atboottime mRun: [iTunesHelper] "d:\program files\itunes\iTunesHelper.exe" mRun: [Windows Defender] "d:\program files\windows defender\MSASCui.exe" -hide mRun: [SpySweeper] "d:\program files\webroot\webrootsecurity\SpySweeperUI.exe" /startintray StartupFolder: d:\docume~1\james~1.jam\startm~1\programs\startup\openof~1.lnk - d:\program files\openoffice.org 3\program\quickstart.exe StartupFolder: d:\docume~1\alluse~1.win\startm~1\programs\startup\logite~2.lnk - d:\program files\logitech\desktop messenger\8876480\program\LogitechDesktopMessenger.exe uPolicies-explorer: = IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - d:\program files\messenger\msmsgs.exe IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - d:\progra~1\spybot~1\SDHelper.dll Trusted Zone: internet Trusted Zone: mcafee.com DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1255988380234 DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} - hxxps://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - d:\program files\logitech\desktop messenger\8876480\program\GAPlugProtocol-8876480.dll Handler: pure-go - {4746C79A-2042-4332-8650-48966E44ABA8} - d:\program files\common files\pure networks shared\platform\puresp4.dll Notify: !SASWinLogon - d:\program files\superantispyware\SASWINLO.DLL SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - d:\windows\system32\WPDShServiceObj.dll SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - d:\program files\superantispyware\SASSEH.DLL SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - d:\progra~1\wifd1f~1\MpShHook.dll Hosts: 127.0.0.1 www.spywareinfo.com ================= FIREFOX =================== FF - ProfilePath - d:\docume~1\james~1.jam\applic~1\mozilla\firefox\profiles\o9fabn40.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/|http://www.msn.com/|highdefforum.com FF - prefs.js: keyword.URL - hxxp://www.google.com/search?q= FF - plugin: d:\documents and settings\james.james-desktop\application data\mozilla\firefox\profiles\o9fabn40.default\extensions\{e2883e8f-472f-4fb0-9522-ac9bf37916a7}\plugins\np_gp.dll FF - plugin: d:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: d:\program files\mcafee\supportability\mvt\NPMVTPlugin.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - d:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\ FF - HiddenExtension: Java Console: No Registry Reference - d:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - d:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - d:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} ---- FIREFOX POLICIES ---- d:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true); d:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false); d:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true); d:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true); d:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32); d:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600); d:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true); d:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true); d:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true); d:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true); d:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true); d:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true); d:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true); d:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true); d:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); d:\program files\mozilla firefox\greprefs\all.js - pref("network.proxy.type", 5); d:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.count", 24); d:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096); d:\program files\mozilla firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45); d:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false); d:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1); d:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false); d:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2); d:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1); d:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25); d:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800); d:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25); d:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5); d:\program files\mozilla firefox\greprefs\all.js - pref("accelerometer.enabled", true); d:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false); d:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true); d:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", ""); d:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false); d:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false); d:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true); d:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600); d:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com"); d:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff"); d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org"); d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com"); d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true); d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false); d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false); d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false); d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true); d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true); d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true); d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true); d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false); d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false); d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20); d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20); ============= SERVICES / DRIVERS =============== R0 ssfs0bbc;ssfs0bbc;d:\windows\system32\drivers\ssfs0bbc.sys [2009-4-21 29808] R1 mfehidk;McAfee Inc. mfehidk;d:\windows\system32\drivers\mfehidk.sys [2009-7-8 214664] R1 SASDIFSV;SASDIFSV;d:\program files\superantispyware\sasdifsv.sys [2010-2-17 12872] R1 SASKUTIL;SASKUTIL;d:\program files\superantispyware\SASKUTIL.SYS [2010-5-10 67656] R2 a2free;a-squared Free Service;d:\program files\a-squared free\a2service.exe [2010-6-24 1872320] R2 MemeoBackgroundService;MemeoBackgroundService;d:\program files\wd\wd anywhere backup\MemeoBackgroundService.exe [2009-4-17 25824] R2 WebrootSpySweeperService;Webroot Spy Sweeper Engine;d:\program files\webroot\webrootsecurity\SpySweeper.exe [2009-11-6 4048240] R2 WinDefend;Windows Defender;d:\program files\windows defender\MsMpEng.exe [2006-11-3 13592] R2 WRConsumerService;Webroot Client Service;d:\program files\webroot\webrootsecurity\WRConsumerService.exe [2009-10-29 1201640] R3 A3AB;D-Link AirPro 802.11a/b Wireless Adapter Service(A3AB);d:\windows\system32\drivers\A3AB.sys [2003-10-22 344800] R3 emu10kx;Creative EMU10K1/EMU10K2 Audio Driver (WDM);d:\windows\system32\drivers\e10kx2k.sys [2001-7-13 1745168] S2 0247471256399842mcinstcleanup;McAfee Application Installer Cleanup (0247471256399842);d:\docume~1\james~1.jam\locals~1\temp\024747~1.exe d:\progra~1\common~1\mcafee\instal~1\cleanup.ini -cleanup -nolog -service --> d:\docume~1\james~1.jam\locals~1\temp\024747~1.exe d:\progra~1\common~1\mcafee\instal~1\cleanup.ini -cleanup -nolog -service [?] S3 mferkdk;McAfee Inc. mferkdk;d:\windows\system32\drivers\mferkdk.sys [2009-10-19 34248] S3 WUSB54GCv3;Compact Wireless-G USB Network Adapter;d:\windows\system32\drivers\WUSB54GCv3.sys [2009-12-28 627072] =============== Created Last 30 ================ 2010-07-17 19:10:11 0 d-----w- d:\program files\Trend Micro 2010-07-08 22:52:07 0 d-----w- d:\docume~1\alluse~1.win\applic~1\RegCure 2010-06-29 03:54:21 0 d-----w- d:\docume~1\alluse~1.win\applic~1\FarmFrenzy3 ==================== Find3M ==================== 2010-05-18 20:35:16 91424 ----a-w- d:\windows\system32\dnssd.dll 2010-05-18 20:35:16 75040 ----a-w- d:\windows\system32\jdns_sd.dll 2010-05-18 20:35:16 197920 ----a-w- d:\windows\system32\dnssdX.dll 2010-05-18 20:35:16 107808 ----a-w- d:\windows\system32\dns-sd.exe 2010-05-10 22:40:05 411368 ----a-w- d:\windows\system32\deployJava1.dll 2009-10-25 21:25:46 32768 --sha-w- d:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009102520091026\index.dat ============= FINISH: 20:15:42.30 ===============