DDS (Ver_10-12-12.02) - NTFSx86 Run by [removed] at 16:20:17.84 on Tue 02/15/2011 Internet Explorer: 6.0.2900.5512 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.248.46 [GMT -8:00] ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\system32\spoolsv.exe svchost.exe C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe svchost.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\System32\svchost.exe -k imgsvc C:\WINDOWS\explorer.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\System32\svchost.exe -k HTTPFilter C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Rick\Desktop\dds.com ============== Pseudo HJT Report =============== uStart Page = about:blank mSearch Bar = hxxp://red.clientapps.yahoo.com/customize/ie/defaults/sb/ymsgr6/*http://www.yahoo.com/ext/search/search.html uInternet Connection Wizard,ShellNext = iexplore uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s uURLSearchHooks: H - No File uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll BHO: Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - d:\program files\adobe\acrobat 6.0\acrobat\activex\AcroIEHelper.dll BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll BHO: AcroIEToolbarHelper Class: {ae7cd045-e861-484f-8273-0445ee161910} - d:\program files\adobe\acrobat 6.0\acrobat\AcroIEFavClient.dll BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - d:\program files\adobe\acrobat 6.0\acrobat\AcroIEFavClient.dll TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll TB: AIM Search: {40d41a8b-d79b-43d7-99a7-9ee0f344c385} - c:\program files\aim toolbar\AIMBar.dll EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File EB: {4528BBE0-4E08-11D5-AD55-00010333D0AD} - No File mRun: [ezShieldProtector for Px] c:\windows\system32\ezSP_Px.exe mRun: [VAIO Recovery] c:\windows\sonysys\vaio recovery\PartSeal.exe mRun: [nwiz] nwiz.exe /installquiet mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [IgfxTray] c:\windows\system32\igfxtray.exe mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe mRun: [ATIPTA] c:\program files\ati technologies\ati control panel\atiptaxx.exe mRun: [ATIModeChange] Ati2mdxx.exe mRun: [AGRSMMSG] AGRSMMSG.exe mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe mRun: [IntelliPoint] "c:\program files\microsoft intellipoint\ipoint.exe" mRun: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent mRun: [iTunesHelper] "d:\program files\itunes\iTunesHelper.exe" mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\bin\AppleSyncNotifier.exe StartupFolder: c:\docume~1\rick\startm~1\programs\startup\monito~2.lnk - c:\program files\eroom 7\ERClient7.exe StartupFolder: c:\docume~1\rick\startm~1\programs\startup\monito~1.lnk - c:\program files\eroom 7\ERClient7.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\acroba~1.lnk - d:\program files\adobe\acrobat 6.0\distillr\acrotray.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpimag~1.lnk - c:\program files\hp\digital imaging\bin\hpqthb08.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\norton~1.lnk - d:\program files\navnt\navapw32.exe IE: &AIM Search - c:\program files\aim toolbar\AIMBar.dll/aimsearch.htm IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office10\EXCEL.EXE/3000 IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBC} - c:\program files\java\jre6\bin\jp2iexp.dll Trusted Zone: edusoft.com\www Trusted Zone: intuit.com\ttlc Trusted Zone: turbotax.com DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/templates/ieawsdc.cab DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204 DPF: {640B39C1-D713-464F-92C3-75BD972B95EE} - hxxp://download.sidestep.com/get/k00719/sb028.cab DPF: {67DDCD98-1120-47C3-B47E-A4E6820A571F} - hxxp://pbworldnet.com/components/intranet.CAB DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - hxxp://www.nick.com/common/groove/gx/GrooveAX27.cab DPF: {7FA319FB-FFB9-4089-87EB-63179244E6E6} - hxxps://pbshares.pbworldnet.com/nortel_cacheable/NetDirect.cab DPF: {88D969C0-F192-11D4-A65F-0040963251E5} - hxxp://www.pbworldnet.com/components/msxml4SP1.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab DPF: {924B4927-D3BA-41EA-9F7E-8A89194AB3AC} - hxxp://panda-plugin.disney.go.com/plugin/win32/p3dactivex.cab DPF: {9B17FE0E-51F2-4692-8B32-8EFB805FC0E7} - hxxp://h30155.www3.hp.com/ediags/dd/install/guidedsolutions.cab DPF: {A2505C6C-6F17-456F-89D2-4301FBDC6EC7} - hxxps://pbshares.pbworldnet.com/nortel_cacheable/iewiper.cab DPF: {B1E2B96C-12FE-45E2-BEF1-44A219113CDD} - hxxp://www.superadblocker.com/activex/sabspx.cab DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - hxxp://us.dl1.yimg.com/download.yahoo.com/dl/installs/suite/yautocomplete.cab DPF: {C4847596-972C-11D0-9567-00A0C9273C2A} - hxxp://reports.projectsolve2.com/viewer/activeXViewer/activexviewer.cab DPF: {CAFEEFAC-0014-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-1_4_0_03-win.cab DPF: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab DPF: {E473A65C-8087-49A3-AFFD-C5BC4A10669B} - hxxp://mvnet.xlontech.net/qm/fox/06101102/qsp2ie06101001.cab Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL Notify: igfxcui - igfxsrvc.dll ============= SERVICES / DRIVERS =============== R1 SASDIFSV;SASDIFSV;d:\program files\sas\sasdifsv.sys [2010-2-17 12872] R1 SASKUTIL;SASKUTIL;d:\program files\sas\SASKUTIL.SYS [2010-5-10 67656] S1 SABKUTIL;SABKUTIL;\??\c:\documents and settings\rick\local settings\temporary internet files\content.ie5\6y35b1u0\sabkutil.sys --> c:\documents and settings\rick\local settings\temporary internet files\content.ie5\6y35b1u0\SABKUTIL.sys [?] S2 gupdate1ca2673dcf70070;Google Update Service (gupdate1ca2673dcf70070);c:\program files\google\update\GoogleUpdate.exe [2009-8-26 133104] S2 NAV Auto-Protect;NAV Auto-Protect;d:\progra~1\navnt\navapsvc.exe --> d:\progra~1\navnt\navapsvc.exe [?] S3 ETUSBW11;ETUSBW11.sys, EnterTech Co.,Ltd. USB MIC 1.1 Driver;c:\windows\system32\drivers\ETUSBW11.sys [2009-1-10 17664] S3 NAV Alert;NAV Alert;d:\progra~1\navnt\alertsvc.exe --> d:\progra~1\navnt\alertsvc.exe [?] S3 NAVAP;NAVAP;c:\windows\system32\drivers\navap.sys [2006-2-19 167744] S3 NAVENG;NAVENG;\??\d:\progra~1\navnt\naveng.sys --> d:\progra~1\navnt\naveng.sys [?] S3 NAVEX15;NAVEX15;\??\d:\progra~1\navnt\navex15.sys --> d:\progra~1\navnt\navex15.sys [?] S3 NetDirect;TAP-Win32 NetDirect Adapter;c:\windows\system32\drivers\netdirect.sys --> c:\windows\system32\drivers\NetDirect.sys [?] =============== Created Last 30 ================ 2011-02-16 00:19:18 -------- d-s---w- c:\windows\Cookies 2011-02-05 05:13:11 388096 ----a-r- c:\docume~1\rick\applic~1\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe 2011-02-05 03:37:56 -------- d-----w- c:\docume~1\rick\applic~1\SUPERAntiSpyware.com 2011-02-02 03:16:54 73728 ----a-w- c:\windows\system32\javacpl.cpl 2011-02-01 03:36:20 -------- d-----w- c:\docume~1\alluse~1\applic~1\Alwil Software 2011-01-26 06:41:10 -------- d-sh--w- c:\documents and settings\rick\IECompatCache 2011-01-24 20:06:22 -------- d-----w- C:\Quarantine 2011-01-23 01:45:48 -------- d-----w- c:\docume~1\rick\applic~1\McAfee 2011-01-23 01:44:35 -------- d-----w- c:\program files\McAfee 2011-01-23 01:42:31 -------- d-----w- C:\mcafee 2011-01-21 14:44:37 439296 -c----w- c:\windows\system32\dllcache\shimgvw.dll 2011-01-19 03:11:22 -------- d-----w- c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com 2011-01-17 21:09:31 -------- d-sha-r- C:\cmdcons 2011-01-17 20:58:00 98816 ----a-w- c:\windows\sed.exe 2011-01-17 20:58:00 89088 ----a-w- c:\windows\MBR.exe 2011-01-17 20:58:00 256512 ----a-w- c:\windows\PEV.exe 2011-01-17 20:58:00 161792 ----a-w- c:\windows\SWREG.exe 2011-01-17 16:53:06 -------- d-sh--w- c:\documents and settings\rick\PrivacIE 2011-01-17 16:49:07 -------- d-sh--w- c:\documents and settings\rick\IETldCache 2011-01-17 16:33:28 -------- d-----w- c:\windows\ie8updates 2011-01-17 16:27:50 81920 -c--a-w- c:\windows\system32\dllcache\ieencode.dll 2011-01-17 16:27:50 81920 ----a-w- c:\windows\system32\ieencode.dll 2011-01-17 16:19:22 7680 -c----w- c:\windows\system32\dllcache\iecompat.dll 2011-01-17 16:18:56 602112 -c----w- c:\windows\system32\dllcache\msfeeds.dll 2011-01-17 16:18:56 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll 2011-01-17 16:18:55 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll 2011-01-17 16:18:54 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll 2011-01-17 16:18:53 247808 -c----w- c:\windows\system32\dllcache\ieproxy.dll 2011-01-17 16:18:52 1991680 -c----w- c:\windows\system32\dllcache\iertutil.dll 2011-01-17 16:18:44 11080704 -c----w- c:\windows\system32\dllcache\ieframe.dll ==================== Find3M ==================== 2011-01-21 14:44:37 439296 ----a-w- c:\windows\system32\shimgvw.dll 2011-01-07 14:09:02 290048 ----a-w- c:\windows\system32\atmfd.dll 2011-01-02 02:48:25 0 ----a-w- c:\windows\Xkaleqozu.bin 2010-12-31 13:10:33 1854976 ----a-w- c:\windows\system32\win32k.sys 2010-12-22 12:34:28 301568 ----a-w- c:\windows\system32\kerberos.dll 2010-12-20 22:15:52 667136 ----a-w- c:\windows\system32\wininet.dll 2010-12-20 22:15:52 61952 ----a-w- c:\windows\system32\tdc.ocx 2010-12-20 17:26:00 730112 ----a-w- c:\windows\system32\lsasrv.dll 2010-12-20 15:30:29 369664 ----a-w- c:\windows\system32\html.iec 2010-12-09 14:30:22 33280 ----a-w- c:\windows\system32\csrsrv.dll 2010-11-18 18:12:44 81920 ----a-w- c:\windows\system32\isign32.dll ============= FINISH: 16:21:14.51 ===============